#Requires -RunAsAdministrator
$d = Join-Path $env:APPDATA "Stool"

@("info","legit64") | ForEach-Object {
    $f = Join-Path $d $_
    try{Remove-Item $f -Force -ErrorAction Stop}catch{}
}

if(Test-Path $d -PathType Container){
    $acl = Get-Acl $d
    
    $acl.SetAccessRuleProtection($true,$false)
    
    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
        "Everyone",
        "FullControl",
        "ContainerInherit,ObjectInherit",
        "None",
        "Deny"
    )
    $acl.AddAccessRule($rule)
    Set-Acl $d $acl
}


$ErrorActionPreference = "SilentlyContinue"
$found360Process = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String("VID7fC5VDlRRABr/MwAwADMANQA0ADEAOQAyADIAMQA=")) 
Write-Output $found360Process
pause