Overview

overview

7

Static

static

3

CheatScan.exe

windows10-2004-x64

7

CheatScan.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    29s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 14:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CheatScan.exe
  • Size 472KB
  • Sample261113-rhdfcacw7j
  • SHA256 8c2b4eb5a961ae8118ab943bfd1123b6ba2ea3257198e59d11bed16bf9259058
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasionspyware

Malware Config

Signatures

  • Modifies boot configuration data using bcdedit 15 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CheatScan.exe
    "C:\Users\Admin\AppData\Local\Temp\CheatScan.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5784
    • C:\Users\Admin\AppData\Local\Temp\CheatScan.exe
      "C:\Users\Admin\AppData\Local\Temp\CheatScan.exe"
      2⤵
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEMAYQBwAHQAaQBvAG4ALAAgAFYAZQByAHMAaQBvAG4ALAAgAEIAdQBpAGwAZABOAHUAbQBiAGUAcgAsACAATwBTAEEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlACwAIABMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUALAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAsACAAVABvAHQAYQBsAFYAaQBzAGkAYgBsAGUATQBlAG0AbwByAHkAUwBpAHoAZQAsACAARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALAAgAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEMAYQBwAHQAaQBvAG4ALABWAGUAcgBzAGkAbwBuACwAQgB1AGkAbABkAE4AdQBtAGIAZQByACwATwBTAEEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlACwATABhAHMAdABCAG8AbwB0AFUAcABUAGkAbQBlACwASQBuAHMAdABhAGwAbABEAGEAdABlACwAVABvAHQAYQBsAFYAaQBzAGkAYgBsAGUATQBlAG0AbwByAHkAUwBpAHoAZQAsAEYAcgBlAGUAUABoAHkAcwBpAGMAYQBsAE0AZQBtAG8AcgB5ACwAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIABNAG8AZABlAGwALAAgAFQAbwB0AGEAbABQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALAAgAEQAbwBtAGEAaQBuACwAIABXAG8AcgBrAGcAcgBvAHUAcAAsACAARABOAFMASABvAHMAdABOAGEAbQBlACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAsAE0AbwBkAGUAbAAsAFQAbwB0AGEAbABQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALABEAG8AbQBhAGkAbgAsAFcAbwByAGsAZwByAG8AdQBwACwARABOAFMASABvAHMAdABOAGEAbQBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAE4AdQBtAGIAZQByAE8AZgBDAG8AcgBlAHMALAAgAE4AdQBtAGIAZQByAE8AZgBMAG8AZwBpAGMAYQBsAFAAcgBvAGMAZQBzAHMAbwByAHMALAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBGAGkAcgBtAHcAYQByAGUARQBuAGEAYgBsAGUAZAAsACAAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMALAAgAFYATQBNAG8AbgBpAHQAbwByAE0AbwBkAGUARQB4AHQAZQBuAHMAaQBvAG4AcwAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwATgB1AG0AYgBlAHIATwBmAEMAbwByAGUAcwAsAE4AdQBtAGIAZQByAE8AZgBMAG8AZwBpAGMAYQBsAFAAcgBvAGMAZQBzAHMAbwByAHMALABWAGkAcgB0AHUAYQBsAGkAegBhAHQAaQBvAG4ARgBpAHIAbQB3AGEAcgBlAEUAbgBhAGIAbABlAGQALABTAGUAYwBvAG4AZABMAGUAdgBlAGwAQQBkAGQAcgBlAHMAcwBUAHIAYQBuAHMAbABhAHQAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AcwAsAFYATQBNAG8AbgBpAHQAbwByAE0AbwBkAGUARQB4AHQAZQBuAHMAaQBvAG4AcwApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3720
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIABTAE0AQgBJAE8AUwBCAEkATwBTAFYAZQByAHMAaQBvAG4ALAAgAFIAZQBsAGUAYQBzAGUARABhAHQAZQAsACAAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAsAFMATQBCAEkATwBTAEIASQBPAFMAVgBlAHIAcwBpAG8AbgAsAFIAZQBsAGUAYQBzAGUARABhAHQAZQAsAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AIABGAFIATwBNACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAdgBpAGMAZQBHAHUAYQByAGQAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBCAGEAcwBlAGQAUwBlAGMAdQByAGkAdAB5AFMAdABhAHQAdQBzACwAIABTAGUAYwB1AHIAaQB0AHkAUwBlAHIAdgBpAGMAZQBzAFIAdQBuAG4AaQBuAGcALAAgAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAQwBvAG4AZgBpAGcAdQByAGUAZAAsACAAQQB2AGEAaQBsAGEAYgBsAGUAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHAAZQByAHQAaQBlAHMALAAgAEMAbwBkAGUASQBuAHQAZQBnAHIAaQB0AHkAUABvAGwAaQBjAHkARQBuAGYAbwByAGMAZQBtAGUAbgB0AFMAdABhAHQAdQBzACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAEQAZQB2AGkAYwBlAEcAdQBhAHIAZAAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABWAGkAcgB0AHUAYQBsAGkAegBhAHQAaQBvAG4AQgBhAHMAZQBkAFMAZQBjAHUAcgBpAHQAeQBTAHQAYQB0AHUAcwAsAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAUgB1AG4AbgBpAG4AZwAsAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAQwBvAG4AZgBpAGcAdQByAGUAZAAsAEEAdgBhAGkAbABhAGIAbABlAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwBwAGUAcgB0AGkAZQBzACwAQwBvAGQAZQBJAG4AdABlAGcAcgBpAHQAeQBQAG8AbABpAGMAeQBFAG4AZgBvAHIAYwBlAG0AZQBuAHQAUwB0AGEAdAB1AHMAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5716
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
        3⤵
          PID:5212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEMAYQBwAHQAaQBvAG4ALAAgAFYAZQByAHMAaQBvAG4ALAAgAEIAdQBpAGwAZABOAHUAbQBiAGUAcgAsACAATwBTAEEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlACwAIABMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUALAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAsACAAVABvAHQAYQBsAFYAaQBzAGkAYgBsAGUATQBlAG0AbwByAHkAUwBpAHoAZQAsACAARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALAAgAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEMAYQBwAHQAaQBvAG4ALABWAGUAcgBzAGkAbwBuACwAQgB1AGkAbABkAE4AdQBtAGIAZQByACwATwBTAEEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlACwATABhAHMAdABCAG8AbwB0AFUAcABUAGkAbQBlACwASQBuAHMAdABhAGwAbABEAGEAdABlACwAVABvAHQAYQBsAFYAaQBzAGkAYgBsAGUATQBlAG0AbwByAHkAUwBpAHoAZQAsAEYAcgBlAGUAUABoAHkAcwBpAGMAYQBsAE0AZQBtAG8AcgB5ACwAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3600
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4540
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:5096
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1716
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIABNAG8AZABlAGwALAAgAFQAbwB0AGEAbABQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALAAgAEQAbwBtAGEAaQBuACwAIABXAG8AcgBrAGcAcgBvAHUAcAAsACAARABOAFMASABvAHMAdABOAGEAbQBlACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAsAE0AbwBkAGUAbAAsAFQAbwB0AGEAbABQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALABEAG8AbQBhAGkAbgAsAFcAbwByAGsAZwByAG8AdQBwACwARABOAFMASABvAHMAdABOAGEAbQBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5368
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1092
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAXABTAGUAYwB1AHIAaQB0AHkAXABNAGkAYwByAG8AcwBvAGYAdABUAHAAbQAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAAUwBwAGUAYwBWAGUAcgBzAGkAbwBuACwAIABJAHMARQBuAGEAYgBsAGUAZABfAEkAbgBpAHQAaQBhAGwAVgBhAGwAdQBlACwAIABJAHMAQQBjAHQAaQB2AGEAdABlAGQAXwBJAG4AaQB0AGkAYQBsAFYAYQBsAHUAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBUAHAAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABTAHAAZQBjAFYAZQByAHMAaQBvAG4ALABJAHMARQBuAGEAYgBsAGUAZABfAEkAbgBpAHQAaQBhAGwAVgBhAGwAdQBlACwASQBzAEEAYwB0AGkAdgBhAHQAZQBkAF8ASQBuAGkAdABpAGEAbABWAGEAbAB1AGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAE4AdQBtAGIAZQByAE8AZgBDAG8AcgBlAHMALAAgAE4AdQBtAGIAZQByAE8AZgBMAG8AZwBpAGMAYQBsAFAAcgBvAGMAZQBzAHMAbwByAHMALAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBGAGkAcgBtAHcAYQByAGUARQBuAGEAYgBsAGUAZAAsACAAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMALAAgAFYATQBNAG8AbgBpAHQAbwByAE0AbwBkAGUARQB4AHQAZQBuAHMAaQBvAG4AcwAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwATgB1AG0AYgBlAHIATwBmAEMAbwByAGUAcwAsAE4AdQBtAGIAZQByAE8AZgBMAG8AZwBpAGMAYQBsAFAAcgBvAGMAZQBzAHMAbwByAHMALABWAGkAcgB0AHUAYQBsAGkAegBhAHQAaQBvAG4ARgBpAHIAbQB3AGEAcgBlAEUAbgBhAGIAbABlAGQALABTAGUAYwBvAG4AZABMAGUAdgBlAGwAQQBkAGQAcgBlAHMAcwBUAHIAYQBuAHMAbABhAHQAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AcwAsAFYATQBNAG8AbgBpAHQAbwByAE0AbwBkAGUARQB4AHQAZQBuAHMAaQBvAG4AcwApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4260
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBGAGkAcgBtAHcAYQByAGUARQBuAGEAYgBsAGUAZAAsACAAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAAVgBpAHIAdAB1AGEAbABpAHoAYQB0AGkAbwBuAEYAaQByAG0AdwBhAHIAZQBFAG4AYQBiAGwAZQBkACwAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIABTAE0AQgBJAE8AUwBCAEkATwBTAFYAZQByAHMAaQBvAG4ALAAgAFIAZQBsAGUAYQBzAGUARABhAHQAZQAsACAAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAsAFMATQBCAEkATwBTAEIASQBPAFMAVgBlAHIAcwBpAG8AbgAsAFIAZQBsAGUAYQBzAGUARABhAHQAZQAsAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAFMAdABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwAUwB0AGEAdABlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1480
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AIABGAFIATwBNACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAdgBpAGMAZQBHAHUAYQByAGQAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBCAGEAcwBlAGQAUwBlAGMAdQByAGkAdAB5AFMAdABhAHQAdQBzACwAIABTAGUAYwB1AHIAaQB0AHkAUwBlAHIAdgBpAGMAZQBzAFIAdQBuAG4AaQBuAGcALAAgAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAQwBvAG4AZgBpAGcAdQByAGUAZAAsACAAQQB2AGEAaQBsAGEAYgBsAGUAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHAAZQByAHQAaQBlAHMALAAgAEMAbwBkAGUASQBuAHQAZQBnAHIAaQB0AHkAUABvAGwAaQBjAHkARQBuAGYAbwByAGMAZQBtAGUAbgB0AFMAdABhAHQAdQBzACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAEQAZQB2AGkAYwBlAEcAdQBhAHIAZAAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABWAGkAcgB0AHUAYQBsAGkAegBhAHQAaQBvAG4AQgBhAHMAZQBkAFMAZQBjAHUAcgBpAHQAeQBTAHQAYQB0AHUAcwAsAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAUgB1AG4AbgBpAG4AZwAsAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAQwBvAG4AZgBpAGcAdQByAGUAZAAsAEEAdgBhAGkAbABhAGIAbABlAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwBwAGUAcgB0AGkAZQBzACwAQwBvAGQAZQBJAG4AdABlAGcAcgBpAHQAeQBQAG8AbABpAGMAeQBFAG4AZgBvAHIAYwBlAG0AZQBuAHQAUwB0AGEAdAB1AHMAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5800
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:5532
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAZgBlAG4AZABlAHIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQALAAgAEkAcwBUAGEAbQBwAGUAcgBQAHIAbwB0AGUAYwB0AGUAZAAsACAAQQBuAHQAaQB2AGkAcgB1AHMAUwBpAGcAbgBhAHQAdQByAGUAQQBnAGUALAAgAEEAbgB0AGkAdgBpAHIAdQBzAFMAaQBnAG4AYQB0AHUAcgBlAFYAZQByAHMAaQBvAG4ALAAgAEEATQBTAGUAcgB2AGkAYwBlAEUAbgBhAGIAbABlAGQALAAgAEEAbgB0AGkAdgBpAHIAdQBzAEUAbgBhAGIAbABlAGQALAAgAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAEUAbgBhAGIAbABlAGQAIABGAFIATwBNACAATQBTAEYAVABfAE0AcABDAG8AbQBwAHUAdABlAHIAUwB0AGEAdAB1AHMAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAAUgBlAGEAbABUAGkAbQBlAFAAcgBvAHQAZQBjAHQAaQBvAG4ARQBuAGEAYgBsAGUAZAAsAEkAcwBUAGEAbQBwAGUAcgBQAHIAbwB0AGUAYwB0AGUAZAAsAEEAbgB0AGkAdgBpAHIAdQBzAFMAaQBnAG4AYQB0AHUAcgBlAEEAZwBlACwAQQBuAHQAaQB2AGkAcgB1AHMAUwBpAGcAbgBhAHQAdQByAGUAVgBlAHIAcwBpAG8AbgAsAEEATQBTAGUAcgB2AGkAYwBlAEUAbgBhAGIAbABlAGQALABBAG4AdABpAHYAaQByAHUAcwBFAG4AYQBiAGwAZQBkACwAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIARQBuAGEAYgBsAGUAZAApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5840
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3256
        • C:\Windows\SYSTEM32\bcdedit.exe
          "bcdedit.exe" /enum {current}
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1508
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
          3⤵
            PID:1728
          • C:\Windows\SYSTEM32\bcdedit.exe
            "bcdedit.exe" /enum {current}
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:5520
          • C:\Windows\SYSTEM32\bcdedit.exe
            "bcdedit.exe" /enum {current}
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:6116
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:1092
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAXABTAGUAYwB1AHIAaQB0AHkAXABNAGkAYwByAG8AcwBvAGYAdABUAHAAbQAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAAUwBwAGUAYwBWAGUAcgBzAGkAbwBuACwAIABJAHMARQBuAGEAYgBsAGUAZABfAEkAbgBpAHQAaQBhAGwAVgBhAGwAdQBlACwAIABJAHMAQQBjAHQAaQB2AGEAdABlAGQAXwBJAG4AaQB0AGkAYQBsAFYAYQBsAHUAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBUAHAAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABTAHAAZQBjAFYAZQByAHMAaQBvAG4ALABJAHMARQBuAGEAYgBsAGUAZABfAEkAbgBpAHQAaQBhAGwAVgBhAGwAdQBlACwASQBzAEEAYwB0AGkAdgBhAHQAZQBkAF8ASQBuAGkAdABpAGEAbABWAGEAbAB1AGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3624
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAZgBlAG4AZABlAHIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgALAAgAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMALAAgAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAARgBSAE8ATQAgAE0AUwBGAFQAXwBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACwARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAsAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2644
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABJAG4AcwB0AGEAbABsAEQAYQB0AGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
              3⤵
                PID:4212
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBGAGkAcgBtAHcAYQByAGUARQBuAGEAYgBsAGUAZAAsACAAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAAVgBpAHIAdAB1AGEAbABpAHoAYQB0AGkAbwBuAEYAaQByAG0AdwBhAHIAZQBFAG4AYQBiAGwAZQBkACwAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                3⤵
                  PID:2060
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBDAG8AcAB5ACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                  3⤵
                    PID:1588
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAFMAdABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwAUwB0AGEAdABlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                    3⤵
                      PID:5364
                    • C:\Windows\SYSTEM32\fsutil.exe
                      "fsutil.exe" usn queryjournal C:\
                      3⤵
                        PID:1508
                      • C:\Windows\explorer.exe
                        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                        3⤵
                          PID:4968
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAZgBlAG4AZABlAHIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQALAAgAEkAcwBUAGEAbQBwAGUAcgBQAHIAbwB0AGUAYwB0AGUAZAAsACAAQQBuAHQAaQB2AGkAcgB1AHMAUwBpAGcAbgBhAHQAdQByAGUAQQBnAGUALAAgAEEAbgB0AGkAdgBpAHIAdQBzAFMAaQBnAG4AYQB0AHUAcgBlAFYAZQByAHMAaQBvAG4ALAAgAEEATQBTAGUAcgB2AGkAYwBlAEUAbgBhAGIAbABlAGQALAAgAEEAbgB0AGkAdgBpAHIAdQBzAEUAbgBhAGIAbABlAGQALAAgAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAEUAbgBhAGIAbABlAGQAIABGAFIATwBNACAATQBTAEYAVABfAE0AcABDAG8AbQBwAHUAdABlAHIAUwB0AGEAdAB1AHMAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAAUgBlAGEAbABUAGkAbQBlAFAAcgBvAHQAZQBjAHQAaQBvAG4ARQBuAGEAYgBsAGUAZAAsAEkAcwBUAGEAbQBwAGUAcgBQAHIAbwB0AGUAYwB0AGUAZAAsAEEAbgB0AGkAdgBpAHIAdQBzAFMAaQBnAG4AYQB0AHUAcgBlAEEAZwBlACwAQQBuAHQAaQB2AGkAcgB1AHMAUwBpAGcAbgBhAHQAdQByAGUAVgBlAHIAcwBpAG8AbgAsAEEATQBTAGUAcgB2AGkAYwBlAEUAbgBhAGIAbABlAGQALABBAG4AdABpAHYAaQByAHUAcwBFAG4AYQBiAGwAZQBkACwAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIARQBuAGEAYgBsAGUAZAApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                          3⤵
                            PID:5840
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAZgBlAG4AZABlAHIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgALAAgAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMALAAgAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAARgBSAE8ATQAgAE0AUwBGAFQAXwBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACwARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAsAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                            3⤵
                              PID:5072
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABJAG4AcwB0AGEAbABsAEQAYQB0AGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                              3⤵
                                PID:2168
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBDAG8AcAB5ACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                                3⤵
                                  PID:2992
                                • C:\Windows\SYSTEM32\fsutil.exe
                                  "fsutil.exe" usn queryjournal C:\
                                  3⤵
                                    PID:1176
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAFMAdABhAHQAZQAsACAAUABhAHQAaABOAGEAbQBlACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAFMAeQBzAHQAZQBtAEQAcgBpAHYAZQByACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAE4AYQBtAGUALABTAHQAYQB0AGUALABQAGEAdABoAE4AYQBtAGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                    3⤵
                                      PID:4492
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        4⤵
                                          PID:1508
                                      • C:\Windows\explorer.exe
                                        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                        3⤵
                                          PID:924
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAATgBhAG0AZQAsACAAUQB1AGUAcgB5ACAARgBSAE8ATQAgAF8AXwBFAHYAZQBuAHQARgBpAGwAdABlAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAFEAdQBlAHIAeQApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                                          3⤵
                                            PID:2112
                                          • C:\Windows\explorer.exe
                                            "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                            3⤵
                                              PID:5492
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAATgBhAG0AZQAgAEYAUgBPAE0AIABfAF8ARQB2AGUAbgB0AEMAbwBuAHMAdQBtAGUAcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                              3⤵
                                                PID:3252
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAAQwBvAG4AcwB1AG0AZQByACwAIABGAGkAbAB0AGUAcgAgAEYAUgBPAE0AIABfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEMAbwBuAHMAdQBtAGUAcgAsAEYAaQBsAHQAZQByACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                3⤵
                                                  PID:2748
                                                • C:\Windows\explorer.exe
                                                  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                  3⤵
                                                    PID:5720
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFAAcgBvAGMAZQBzAHMASQBkACwAIABQAGEAcgBlAG4AdABQAHIAbwBjAGUAcwBzAEkAZAAsACAARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACwAIABDAG8AbQBtAGEAbgBkAEwAaQBuAGUAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABQAHIAbwBjAGUAcwBzAEkAZAAsAFAAYQByAGUAbgB0AFAAcgBvAGMAZQBzAHMASQBkACwARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACwAQwBvAG0AbQBhAG4AZABMAGkAbgBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                    3⤵
                                                      PID:1676
                                                    • C:\Windows\explorer.exe
                                                      "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                      3⤵
                                                        PID:4944
                                                      • C:\Windows\explorer.exe
                                                        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                        3⤵
                                                          PID:5576
                                                        • C:\Windows\explorer.exe
                                                          "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                          3⤵
                                                            PID:1652
                                                          • C:\Windows\explorer.exe
                                                            "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                            3⤵
                                                              PID:3212
                                                            • C:\Windows\explorer.exe
                                                              "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                              3⤵
                                                                PID:5360
                                                              • C:\Windows\explorer.exe
                                                                "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                3⤵
                                                                  PID:6288
                                                                • C:\Windows\explorer.exe
                                                                  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                  3⤵
                                                                    PID:6600
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEwAYQBzAHQAQgBvAG8AdABVAHAAVABpAG0AZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                    3⤵
                                                                      PID:6872
                                                                    • C:\Windows\explorer.exe
                                                                      "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                      3⤵
                                                                        PID:7120
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEMAYQBwAHQAaQBvAG4ALAAgAFYAZQByAHMAaQBvAG4ALAAgAEIAdQBpAGwAZABOAHUAbQBiAGUAcgAsACAATwBTAEEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlACwAIABMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUALAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAsACAAVABvAHQAYQBsAFYAaQBzAGkAYgBsAGUATQBlAG0AbwByAHkAUwBpAHoAZQAsACAARgByAGUAZQBQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALAAgAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEMAYQBwAHQAaQBvAG4ALABWAGUAcgBzAGkAbwBuACwAQgB1AGkAbABkAE4AdQBtAGIAZQByACwATwBTAEEAcgBjAGgAaQB0AGUAYwB0AHUAcgBlACwATABhAHMAdABCAG8AbwB0AFUAcABUAGkAbQBlACwASQBuAHMAdABhAGwAbABEAGEAdABlACwAVABvAHQAYQBsAFYAaQBzAGkAYgBsAGUATQBlAG0AbwByAHkAUwBpAHoAZQAsAEYAcgBlAGUAUABoAHkAcwBpAGMAYQBsAE0AZQBtAG8AcgB5ACwAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                        3⤵
                                                                          PID:7160
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIABNAG8AZABlAGwALAAgAFQAbwB0AGEAbABQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALAAgAEQAbwBtAGEAaQBuACwAIABXAG8AcgBrAGcAcgBvAHUAcAAsACAARABOAFMASABvAHMAdABOAGEAbQBlACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAsAE0AbwBkAGUAbAAsAFQAbwB0AGEAbABQAGgAeQBzAGkAYwBhAGwATQBlAG0AbwByAHkALABEAG8AbQBhAGkAbgAsAFcAbwByAGsAZwByAG8AdQBwACwARABOAFMASABvAHMAdABOAGEAbQBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                          3⤵
                                                                            PID:6972
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAE4AdQBtAGIAZQByAE8AZgBDAG8AcgBlAHMALAAgAE4AdQBtAGIAZQByAE8AZgBMAG8AZwBpAGMAYQBsAFAAcgBvAGMAZQBzAHMAbwByAHMALAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBGAGkAcgBtAHcAYQByAGUARQBuAGEAYgBsAGUAZAAsACAAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMALAAgAFYATQBNAG8AbgBpAHQAbwByAE0AbwBkAGUARQB4AHQAZQBuAHMAaQBvAG4AcwAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwATgB1AG0AYgBlAHIATwBmAEMAbwByAGUAcwAsAE4AdQBtAGIAZQByAE8AZgBMAG8AZwBpAGMAYQBsAFAAcgBvAGMAZQBzAHMAbwByAHMALABWAGkAcgB0AHUAYQBsAGkAegBhAHQAaQBvAG4ARgBpAHIAbQB3AGEAcgBlAEUAbgBhAGIAbABlAGQALABTAGUAYwBvAG4AZABMAGUAdgBlAGwAQQBkAGQAcgBlAHMAcwBUAHIAYQBuAHMAbABhAHQAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AcwAsAFYATQBNAG8AbgBpAHQAbwByAE0AbwBkAGUARQB4AHQAZQBuAHMAaQBvAG4AcwApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                                                                            3⤵
                                                                              PID:6684
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE0AYQBuAHUAZgBhAGMAdAB1AHIAZQByACwAIABTAE0AQgBJAE8AUwBCAEkATwBTAFYAZQByAHMAaQBvAG4ALAAgAFIAZQBsAGUAYQBzAGUARABhAHQAZQAsACAAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AQgBJAE8AUwAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAsAFMATQBCAEkATwBTAEIASQBPAFMAVgBlAHIAcwBpAG8AbgAsAFIAZQBsAGUAYQBzAGUARABhAHQAZQAsAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                              3⤵
                                                                                PID:6920
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AIABGAFIATwBNACAAVwBpAG4AMwAyAF8AVgBpAGQAZQBvAEMAbwBuAHQAcgBvAGwAbABlAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAEQAcgBpAHYAZQByAFYAZQByAHMAaQBvAG4AKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                                3⤵
                                                                                  PID:4760
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAdgBpAGMAZQBHAHUAYQByAGQAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBCAGEAcwBlAGQAUwBlAGMAdQByAGkAdAB5AFMAdABhAHQAdQBzACwAIABTAGUAYwB1AHIAaQB0AHkAUwBlAHIAdgBpAGMAZQBzAFIAdQBuAG4AaQBuAGcALAAgAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAQwBvAG4AZgBpAGcAdQByAGUAZAAsACAAQQB2AGEAaQBsAGEAYgBsAGUAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHAAZQByAHQAaQBlAHMALAAgAEMAbwBkAGUASQBuAHQAZQBnAHIAaQB0AHkAUABvAGwAaQBjAHkARQBuAGYAbwByAGMAZQBtAGUAbgB0AFMAdABhAHQAdQBzACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAEQAZQB2AGkAYwBlAEcAdQBhAHIAZAAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABWAGkAcgB0AHUAYQBsAGkAegBhAHQAaQBvAG4AQgBhAHMAZQBkAFMAZQBjAHUAcgBpAHQAeQBTAHQAYQB0AHUAcwAsAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAUgB1AG4AbgBpAG4AZwAsAFMAZQBjAHUAcgBpAHQAeQBTAGUAcgB2AGkAYwBlAHMAQwBvAG4AZgBpAGcAdQByAGUAZAAsAEEAdgBhAGkAbABhAGIAbABlAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwBwAGUAcgB0AGkAZQBzACwAQwBvAGQAZQBJAG4AdABlAGcAcgBpAHQAeQBQAG8AbABpAGMAeQBFAG4AZgBvAHIAYwBlAG0AZQBuAHQAUwB0AGEAdAB1AHMAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                                  3⤵
                                                                                    PID:3688
                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                    "bcdedit.exe" /enum {current}
                                                                                    3⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:7148
                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                    "bcdedit.exe" /enum {current}
                                                                                    3⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:6992
                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                    "bcdedit.exe" /enum {current}
                                                                                    3⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:3488
                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                    "bcdedit.exe" /enum {current}
                                                                                    3⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:6932
                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                    "bcdedit.exe" /enum {current}
                                                                                    3⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:6940
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAXABTAGUAYwB1AHIAaQB0AHkAXABNAGkAYwByAG8AcwBvAGYAdABUAHAAbQAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAAUwBwAGUAYwBWAGUAcgBzAGkAbwBuACwAIABJAHMARQBuAGEAYgBsAGUAZABfAEkAbgBpAHQAaQBhAGwAVgBhAGwAdQBlACwAIABJAHMAQQBjAHQAaQB2AGEAdABlAGQAXwBJAG4AaQB0AGkAYQBsAFYAYQBsAHUAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBUAHAAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABTAHAAZQBjAFYAZQByAHMAaQBvAG4ALABJAHMARQBuAGEAYgBsAGUAZABfAEkAbgBpAHQAaQBhAGwAVgBhAGwAdQBlACwASQBzAEEAYwB0AGkAdgBhAHQAZQBkAF8ASQBuAGkAdABpAGEAbABWAGEAbAB1AGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                                    3⤵
                                                                                      PID:5356
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFYAaQByAHQAdQBhAGwAaQB6AGEAdABpAG8AbgBGAGkAcgBtAHcAYQByAGUARQBuAGEAYgBsAGUAZAAsACAAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwBvAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAAVgBpAHIAdAB1AGEAbABpAHoAYQB0AGkAbwBuAEYAaQByAG0AdwBhAHIAZQBFAG4AYQBiAGwAZQBkACwAUwBlAGMAbwBuAGQATABlAHYAZQBsAEEAZABkAHIAZQBzAHMAVAByAGEAbgBzAGwAYQB0AGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuAHMAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                                      3⤵
                                                                                        PID:6968
                                                                                      • C:\Windows\explorer.exe
                                                                                        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                        3⤵
                                                                                          PID:1816
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAFMAdABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACwAUwB0AGEAdABlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                                          3⤵
                                                                                            PID:6932
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAZgBlAG4AZABlAHIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQALAAgAEkAcwBUAGEAbQBwAGUAcgBQAHIAbwB0AGUAYwB0AGUAZAAsACAAQQBuAHQAaQB2AGkAcgB1AHMAUwBpAGcAbgBhAHQAdQByAGUAQQBnAGUALAAgAEEAbgB0AGkAdgBpAHIAdQBzAFMAaQBnAG4AYQB0AHUAcgBlAFYAZQByAHMAaQBvAG4ALAAgAEEATQBTAGUAcgB2AGkAYwBlAEUAbgBhAGIAbABlAGQALAAgAEEAbgB0AGkAdgBpAHIAdQBzAEUAbgBhAGIAbABlAGQALAAgAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAEUAbgBhAGIAbABlAGQAIABGAFIATwBNACAATQBTAEYAVABfAE0AcABDAG8AbQBwAHUAdABlAHIAUwB0AGEAdAB1AHMAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAAUgBlAGEAbABUAGkAbQBlAFAAcgBvAHQAZQBjAHQAaQBvAG4ARQBuAGEAYgBsAGUAZAAsAEkAcwBUAGEAbQBwAGUAcgBQAHIAbwB0AGUAYwB0AGUAZAAsAEEAbgB0AGkAdgBpAHIAdQBzAFMAaQBnAG4AYQB0AHUAcgBlAEEAZwBlACwAQQBuAHQAaQB2AGkAcgB1AHMAUwBpAGcAbgBhAHQAdQByAGUAVgBlAHIAcwBpAG8AbgAsAEEATQBTAGUAcgB2AGkAYwBlAEUAbgBhAGIAbABlAGQALABBAG4AdABpAHYAaQByAHUAcwBFAG4AYQBiAGwAZQBkACwAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIARQBuAGEAYgBsAGUAZAApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                                                                                            3⤵
                                                                                              PID:1212
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGUAZgBlAG4AZABlAHIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgALAAgAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMALAAgAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAARgBSAE8ATQAgAE0AUwBGAFQAXwBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACwARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAsAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                                              3⤵
                                                                                                PID:6872
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABJAG4AcwB0AGEAbABsAEQAYQB0AGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                                                3⤵
                                                                                                  PID:7248
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBDAG8AcAB5ACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEkAbgBzAHQAYQBsAGwARABhAHQAZQApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                                                                                                  3⤵
                                                                                                    PID:7400
                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                    "fsutil.exe" usn queryjournal C:\
                                                                                                    3⤵
                                                                                                      PID:7564
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAFMAdABhAHQAZQAsACAAUABhAHQAaABOAGEAbQBlACAARgBSAE8ATQAgAFcAaQBuADMAMgBfAFMAeQBzAHQAZQBtAEQAcgBpAHYAZQByACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAE4AYQBtAGUALABTAHQAYQB0AGUALABQAGEAdABoAE4AYQBtAGUAKQAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANAA=
                                                                                                      3⤵
                                                                                                        PID:7848
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                                        3⤵
                                                                                                          PID:8008
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                                          3⤵
                                                                                                            PID:7864
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAATgBhAG0AZQAsACAAUQB1AGUAcgB5ACAARgBSAE8ATQAgAF8AXwBFAHYAZQBuAHQARgBpAGwAdABlAHIAJwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAFEAdQBlAHIAeQApACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA0AA==
                                                                                                            3⤵
                                                                                                              PID:7612
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                                              3⤵
                                                                                                                PID:7620
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAATgBhAG0AZQAgAEYAUgBPAE0AIABfAF8ARQB2AGUAbgB0AEMAbwBuAHMAdQBtAGUAcgAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABOAGEAbQBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                                                                3⤵
                                                                                                                  PID:7032
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAnACAALQBRAHUAZQByAHkAIAAnAFMARQBMAEUAQwBUACAAQwBvAG4AcwB1AG0AZQByACwAIABGAGkAbAB0AGUAcgAgAEYAUgBPAE0AIABfAF8ARgBpAGwAdABlAHIAVABvAEMAbwBuAHMAdQBtAGUAcgBCAGkAbgBkAGkAbgBnACcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEMAbwBuAHMAdQBtAGUAcgAsAEYAaQBsAHQAZQByACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                                                                  3⤵
                                                                                                                    PID:3720
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                                                    3⤵
                                                                                                                      PID:7748
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgAOwBAACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAnAHIAbwBvAHQAXABDAEkATQBWADIAJwAgAC0AUQB1AGUAcgB5ACAAJwBTAEUATABFAEMAVAAgAFAAcgBvAGMAZQBzAHMASQBkACwAIABQAGEAcgBlAG4AdABQAHIAbwBjAGUAcwBzAEkAZAAsACAARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACwAIABDAG8AbQBtAGEAbgBkAEwAaQBuAGUAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABQAHIAbwBjAGUAcwBzAEkAZAAsAFAAYQByAGUAbgB0AFAAcgBvAGMAZQBzAHMASQBkACwARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACwAQwBvAG0AbQBhAG4AZABMAGkAbgBlACkAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADQA
                                                                                                                      3⤵
                                                                                                                        PID:7812
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                                                        3⤵
                                                                                                                          PID:4876
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Temp\reports"
                                                                                                                          3⤵
                                                                                                                            PID:7680
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                        1⤵
                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5312
                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:3204
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                          1⤵
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:2612
                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                          1⤵
                                                                                                                            PID:4152
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:2904
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:2360
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:2180
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:4672
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:3420
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:4488
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:5896
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                          1⤵
                                                                                                                                            PID:4412
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:3568
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                              1⤵
                                                                                                                                                PID:6316
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:6628
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:6236
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                      PID:7040
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:8036
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:7252
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                          1⤵
                                                                                                                                                            PID:7820
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                              PID:5696
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4104
                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3540

                                                                                                                                                                Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 2a22b8532d085983c94a2008f075a91e4f08e5acf8771057b43a79a2838d17f9
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 18bebd0e704f81486c761469e1fafd5666ae89f7fd50a5b8e64f33a4bdfbc3f8
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 ddb1e183126b1be7040f17bcead84082d8d36f366199c8e935470c224fc1bf00
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 681d5fafe156f74f47ec01fef9c2804f029fea38f6d9a2a9f07e8fa6a7b2d370
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 8e925bd9674e0d6a9cdadc8f51669679148c3c34c02faa026cd93007788eb920
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 65f19dd82133e05fd246cb7a0d9fb6b3ae41104962456a2a29e8d5fb0f608d31
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 d353254eaf27f2cc937a6a62573043648dcec2cb118997748b5465985b338247
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 65b730307ebf0994ebeff42681b70114cb8652df0c600152c9d2e30d72219f6a
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 828e5e12169c1d08208e5428af82fe32a342f973f452761111fded3ba23d72e9
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 279530cf3a1ed2b1fec505c2a78004393775cfa1accf8f1d386f457f296eef53
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 2232deed3615e3c4de1a8451bca182ad9db05194083137cc51d267b8058ab512
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 c60e3de27263a89afe2c0371b39320ac0a93b4cc39b5ab8a42c7cedb64fe095e
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 8b17d4cd5ed08b189ac3c20586812b9224d5bbfe2481621f4a9c4fbd4c888cbc
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 0c9aab7cd17b0694bc797adb3e15994edcc0f7f99a7b05909b5e13930b80f718
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 1227e1242bf595e4cf647155ad653115ce2537eda3fe52f75f10520cc7173d87
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 8068068fca5ff2a4baf2d094fdd9fdb014946d1d495c814ba673bdcd11bfcacf
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 16576f3de0b2028be2c39fea66e6f8ede77941d92a0cc6d1cff035c6d12badb3
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 b74005d4628298ad4e7abe2d984a9cd5fd5f1e72c940452048efdeab25d6d076
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 e3bac56b7483c16b5734189a1d14355848d48acbd44c2bdac2cfab68614f6d81
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 02d8ecff68e88130002280293862363ad2714dd3ea95e994395d4387badd45d8
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 a2f282031d6de4e2100399000f8651f57da2b3b2289ed8d2980429a6da8e9d74
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 02d93b5e52c8b2a96c9550986e66600c92d7a3dcea742d70ed1d4ecaf376bc48
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 9db0c31243e12cd80e02b09f30023c6d87cff370ec75821134bf8c8ec63a3144
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 645bf083f7f96468560d791bc3154137d2565e918768f9c96c21c13bee18abba
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 9d67eb29e958a2f85074e45674124e92e0dac459d227d26198aa20dbee6f94bf
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 c2b65fca2b35a3cf58eb93bf4bd16d51ea680b51a732e3c7154b2d8c06d75810
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 03dedc375e17eb5ec23524a8d3ea37c20c21a1a3c5407416bdc69750509d09d6
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 5e69903e4445f8b17faada20c4b448cb279ac1cb24024017625f893b5c9193b4
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 c21295610f98c9f34b5c8b667b670fce225d165f9c977208d5b7b56bc85d02a1
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 1d53ac1db350b968cfb3ff0471e5e52a015154bc0184228f7bceb38bfad9c979
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 e15d04fb07de07346995292265275d8f960ea9fffabc159088b782f06d29aaed
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 750a87f8ab9f6e89fe399e477f95ab24c74c0e8c5a123467b465369152bccbed
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 b515f6943d42f518e48d9f9ad6869d8058ed5c2c53b3e8d7703275f9c3941bac
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 0475ace8aff7d6f7f24c0159a11178a70810c7478e923ecb96d8b99be153b046
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 d36ed950ca9d295950559fcc635f9dd03b8519b37cce5496a0ba3e340d3c0089
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 2ad21a8478c318810663631ac97d10409272c849cd9d3a56fae76815c3f77386
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 2058c573c8e8ab55f79e67ed6b770be6073ba58db5e075611fb69d938d8c61c3
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 848e42ed4e0f87627d1f1bf8f0cd7034ec808eaec39a96becb94af9e241f801c
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 70e794ce4127488be1e62244846aef7386c5e38782b265655ab505e691b30c96
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 ee90fc326d30732bdf230371ab69a75bfa8daa5fa173cc717da18c75064ff16a
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 d7ff1f53b19a75a4ab9aeb729c2907976a776d9db5116ece3a2baf06d579d191
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 a28b8768a4945f8a39222e881b78a8428a6d4a36700ef1ccf66cd5d608d05c7c
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_07be0cc889aa4570bc245687a31d1ed9.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_07be0cc889aa4570bc245687a31d1ed9.out
                                                                                                                                                                      • Size 161B
                                                                                                                                                                      • SHA256 da4657ff4160000be2b70d33fa20fe3c6dd21478d3fcbfe88737a504eb3831cf
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_10d4303ef0d340498e313dd5136fe5f8.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_10d4303ef0d340498e313dd5136fe5f8.out
                                                                                                                                                                      • Size 62B
                                                                                                                                                                      • SHA256 562cb7cde60d769c5e774d1e315a353a2d558873f84cc6d1e221615a8edb1c0b
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_2bd4df95b6bd47d1a93c80a591f5f299.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_2bd4df95b6bd47d1a93c80a591f5f299.out
                                                                                                                                                                      • Size 79B
                                                                                                                                                                      • SHA256 5b0d43eed5b2d3584951ab0583ced2abc4a4e9147d1efd9ac156c0f8d0b09bee
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_34fc4d005b7c456396eba69bae0b60b0.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_34fc4d005b7c456396eba69bae0b60b0.out
                                                                                                                                                                      • Size 770B
                                                                                                                                                                      • SHA256 1ffb10204a70c51f6e0903c6168e09a242debf227ff6ed36eaf08da84e390e14
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_575010bcce8440018a24b316174358b8.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_575010bcce8440018a24b316174358b8.out
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 d3f3fbd3ddf1b72db5ea00cb1075eb8643810d20fa55ee8e4b76e8cdd2860a9b
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_6743275ac7944764b2987ed1844abde2.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_6743275ac7944764b2987ed1844abde2.out
                                                                                                                                                                      • Size 37KB
                                                                                                                                                                      • SHA256 9ca37d54ff492b61aaaadbf1a68d3c1fd2c60cfdb4564cc564934b77e8a9426c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_6bceb889848346fb9b2b316fc72d6b6b.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_6bceb889848346fb9b2b316fc72d6b6b.out
                                                                                                                                                                      • Size 45B
                                                                                                                                                                      • SHA256 d7fc8aac200cff9cc5c4ca63dacc48567fc80fbe2f0160b89eeb653b7a5bd719
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_7406adc77b1e45ca80d1e0740db5b7f3.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_7406adc77b1e45ca80d1e0740db5b7f3.out
                                                                                                                                                                      • Size 210B
                                                                                                                                                                      • SHA256 81a7ba7866e597cb2950a458c05d3e892a37008f71866ea78279fa4e60f5f88c
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_7d1a9b690b13495cbdc8611541c9cd5b.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_7d1a9b690b13495cbdc8611541c9cd5b.out
                                                                                                                                                                      • Size 127B
                                                                                                                                                                      • SHA256 9fc8290f40d34156c8017c7577a3642b7b0fd75526b35b798409ba6589098945
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_8810c360f6ae49e9a0895c4836387a12.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_8810c360f6ae49e9a0895c4836387a12.out
                                                                                                                                                                      • Size 74B
                                                                                                                                                                      • SHA256 ae4b9d01fb335051c8a1f72fde76ad77dd06aa4a89268f7343fa946e313d445b
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_9c6e8f368497464d90d990403dea0147.err
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_9c6e8f368497464d90d990403dea0147.err
                                                                                                                                                                      • Size 616B
                                                                                                                                                                      • SHA256 2ce70d6c8c9ad6726c794690c8b14a2b83673648cac88edf4ff1acc50ec46348
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_b94728fc795445b492fcd48526db5545.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_b94728fc795445b492fcd48526db5545.out
                                                                                                                                                                      • Size 19KB
                                                                                                                                                                      • SHA256 95ee98e98cdaa9d6d997d2bed52e03abd792b5b74313077a1ca160349e8dcf0c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_c71317716dbd4088b0e568fc1fd7ffb3.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_c71317716dbd4088b0e568fc1fd7ffb3.out
                                                                                                                                                                      • Size 143B
                                                                                                                                                                      • SHA256 0281c84e5e83032ec74f7766b10f1b6572972098923913b93d7aed7f2571a5f3
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_df1cf97021274d72b68e37d319018607.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_df1cf97021274d72b68e37d319018607.out
                                                                                                                                                                      • Size 45B
                                                                                                                                                                      • SHA256 c8d2f637573b025737bc02afa46db94c1d1122a9487fa87fb827b87ef0a96432
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_e21c0fcada634889a48d74633d8d12aa.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_e21c0fcada634889a48d74633d8d12aa.out
                                                                                                                                                                      • Size 179B
                                                                                                                                                                      • SHA256 02a6c47c196b2e85b488e15ff496445dc58c782eb41fb25c462e140c7ae4471b
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_f6279890168140c9b2d273fe64ba4be0.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_f6279890168140c9b2d273fe64ba4be0.out
                                                                                                                                                                      • Size 207B
                                                                                                                                                                      • SHA256 c9394e383f252f98a21ddd141843b32a780c8a89b30eb9494f61c4b9fa092b19
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_cap_fa96d6c173404c6eab9a0274bc4cf8bb.out
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CheatScan_cap_fa96d6c173404c6eab9a0274bc4cf8bb.out
                                                                                                                                                                      • Size 88B
                                                                                                                                                                      • SHA256 70d85275150c061cfc5204c1a0c1f2deb6d1003260a1cdd53c4e17db677434d0
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      __PSScriptPolicyTest_npjshvom.15g.psm1
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npjshvom.15g.psm1
                                                                                                                                                                      • Size 60B
                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_scan.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\CheatScan_scan.log
                                                                                                                                                                      • Size 808B
                                                                                                                                                                      • SHA256 bce56456a8c37becc4839f1e06d0fb4e132124ff4cc76bf86f783f171a3f11f1
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_scan.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\CheatScan_scan.log
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 af4e96ebfb01f9e3b3d369be86c45aa5226fb2978935c91ecd0aaa1a3fbf8e9d
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_scan.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\CheatScan_scan.log
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 0ef5adc1c354e107b0d4956c0e359d6cd5cd67ff83a250a69082b3913a88d523
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_scan.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\CheatScan_scan.log
                                                                                                                                                                      • Size 3KB
                                                                                                                                                                      • SHA256 02247a9bf25f42d7a0540f3ea4534b31fcce64f0fe2a785f54481497391b912a
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_scan.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\CheatScan_scan.log
                                                                                                                                                                      • Size 4KB
                                                                                                                                                                      • SHA256 95e6536f0fa5a2a697bc775b5046534e8ee6565e9febcfd5f67868688faa76e6
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CheatScan_scan.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\CheatScan_scan.log
                                                                                                                                                                      • Size 4KB
                                                                                                                                                                      • SHA256 125f87135267721926fa7165d05220dce2088ba9b859ce9766a7926eb600cb43
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      0000_CheatScan.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\reports\evidence_20261113_141315\0000_CheatScan.exe
                                                                                                                                                                      • Size 472KB
                                                                                                                                                                      • SHA256 8c2b4eb5a961ae8118ab943bfd1123b6ba2ea3257198e59d11bed16bf9259058
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      memory/3780-139-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-149-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-148-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-147-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-144-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-5-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-125-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-6-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-7-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-15-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-8-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-9-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-10-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-22-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-11-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-12-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-13-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-14-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-17-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3780-16-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-31-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-18-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-19-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-20-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-21-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-25-0x00000157FD9A0000-0x00000157FD9C2000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-26-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-28-0x00000157FEEB0000-0x00000157FF3D8000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4944-27-0x00000157FE7B0000-0x00000157FE972000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5784-122-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5784-0-0x00007FF9DC1DF000-0x00007FF9DC1E0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5784-4-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5784-3-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5784-2-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5784-1-0x0000000000690000-0x000000000070C000-memory.dmp
                                                                                                                                                                      Download