1f75a4165bfd37b5c497d771ddc81c06daf4303f23973dd957ce3fcb52fd6966

Analysis

max time kernel
243s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
blackbird.exe
Size 610KB
Sample240318-sbv79aca7t
SHA256 1f75a4165bfd37b5c497d771ddc81c06daf4303f23973dd957ce3fcb52fd6966
MD5 6888e4803cdd4d904b23aaab78cbf8ce
SHA1 9b96b45a1cb0c828abb6c6018b851c9dab505132
SHA512 4331824c27149cb9bf859f132e9e231673c8af6a0b5a710e230f2cbe2359b3a0cd9217ff6e88bfdbcfa950ac3ad26ca9521656396a27a6a5edb75d10338128e6
SSDEEP 12288:yGmVTioZtOxl9vPlH1J8B3ljIRvx+hSFVcS5ZSUz+etipUg9VGvnz:xmiAoxlFN1J8B35MvIhSEmEUY9Vc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit upx

Malware Config

Signatures

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Possible privilege escalation attempt 19 IoCs

exploit

pid	Process
2064	icacls.exe
1636	icacls.exe
4856	takeown.exe
1700	icacls.exe
5040	icacls.exe
3368	icacls.exe
1544	takeown.exe
1852	icacls.exe
3292	takeown.exe
4684	icacls.exe
4868	icacls.exe
1280	icacls.exe
3108	icacls.exe
4212	icacls.exe
2144	icacls.exe
3716	icacls.exe
2040	icacls.exe
2312	icacls.exe
4124	icacls.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Modifies file permissions 1 TTPs 19 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1544	takeown.exe
3716	icacls.exe
1636	icacls.exe
4124	icacls.exe
3108	icacls.exe
2040	icacls.exe
1700	icacls.exe
4856	takeown.exe
2312	icacls.exe
1280	icacls.exe
4868	icacls.exe
4212	icacls.exe
1852	icacls.exe
3292	takeown.exe
3368	icacls.exe
4684	icacls.exe
2144	icacls.exe
5040	icacls.exe
2064	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/232-0-0x0000000140000000-0x00000001400B7000-memory.dmp	upx
behavioral2/memory/232-32-0x0000000140000000-0x00000001400B7000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps	attrib.exe
File opened for modification	C:\Program Files\WindowsApps	attrib.exe
File opened for modification	C:\Program Files\WindowsApps	attrib.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1972	Process not Found
4580	Process not Found
2556	Process not Found
3180	sc.exe
3308	Process not Found
2752	Process not Found
2236	Process not Found
2564	Process not Found
1124	Process not Found
4956	Process not Found
2088	Process not Found
4836	Process not Found
2972	Process not Found
4068	Process not Found
4780	Process not Found
4008	Process not Found
1448	Process not Found
3576	Process not Found
4112	Process not Found
848	Process not Found
1420	Process not Found
2396	sc.exe
1188	Process not Found
1896	Process not Found
3292	Process not Found
2128	Process not Found
4388	Process not Found
4212	Process not Found
3000	Process not Found
4668	Process not Found
4544	Process not Found
4404	Process not Found
1708	Process not Found
4504	Process not Found
3488	Process not Found
1224	Process not Found
1532	Process not Found
4772	Process not Found
5044	Process not Found
2944	Process not Found
4860	Process not Found
2188	Process not Found
5032	Process not Found
1568	Process not Found
5016	sc.exe
3736	Process not Found
4172	Process not Found
2844	Process not Found
2928	Process not Found
1220	sc.exe
644	Process not Found
2976	Process not Found
3420	Process not Found
1100	Process not Found
4876	Process not Found
3012	Process not Found
4428	Process not Found
2888	Process not Found
5084	Process not Found
1176	Process not Found
2772	Process not Found
2732	Process not Found
2792	Process not Found
4404	Process not Found

Delays execution with timeout.exe 26 IoCs

evasion

pid	Process
1136	Process not Found
4056	Process not Found
920	Process not Found
4356	Process not Found
4036	Process not Found
1448	Process not Found
1176	Process not Found
2644	Process not Found
4668	Process not Found
2772	Process not Found
1080	Process not Found
2752	Process not Found
4624	Process not Found
2940	Process not Found
3376	Process not Found
4952	Process not Found
2900	Process not Found
3064	Process not Found
3392	Process not Found
2516	Process not Found
1448	Process not Found
2720	Process not Found
1332	Process not Found
1180	Process not Found
212	Process not Found
4608	Process not Found

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Kills process with taskkill 10 IoCs

evasion

pid	Process
3620	taskkill.exe
3404	taskkill.exe
2148	taskkill.exe
4036	taskkill.exe
472	taskkill.exe
1732	taskkill.exe
1192	taskkill.exe
1952	taskkill.exe
4588	taskkill.exe
1104	taskkill.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe\CortanaStartupId\State = "1"	Process not Found
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell\open	Process not Found
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData	Process not Found
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	Process not Found
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.549981C3F5F10_8wekyb3d8bbwe	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows	Process not Found

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4768	Process not Found
2536	Process not Found
2504	reg.exe
1100	Process not Found
4612	Process not Found
64	Process not Found
2628	Process not Found
3912	Process not Found
2236	Process not Found
4936	Process not Found
3468	Process not Found
412	Process not Found
4128	Process not Found
4512	Process not Found
3952	Process not Found
4528	reg.exe
3612	Process not Found
2948	Process not Found
2792	Process not Found
4344	reg.exe
1544	Process not Found
2240	Process not Found
1644	reg.exe
684	Process not Found
1576	Process not Found
4360	reg.exe
3900	Process not Found
3876	Process not Found
3720	Process not Found
4900	Process not Found
2976	Process not Found
2128	reg.exe
4556	Process not Found
4344	reg.exe
1072	Process not Found
2040	Process not Found
3864	Process not Found
3568	Process not Found
4396	reg.exe
3052	reg.exe
1256	Process not Found
4620	Process not Found
1660	Process not Found
3912	Process not Found
1244	Process not Found
2088	reg.exe
1156	Process not Found
1192	Process not Found
1220	Process not Found
3388	Process not Found
4928	Process not Found
2320	Process not Found
4816	Process not Found
2312	Process not Found
3680	Process not Found
2304	Process not Found
1532	Process not Found
3304	Process not Found
4112	Process not Found
1456	reg.exe
4080	Process not Found
5000	Process not Found
2868	Process not Found
4376	Process not Found

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2556	powershell.exe
2556	powershell.exe
1980	powershell.exe
1980	powershell.exe
4364	powershell.exe
4364	powershell.exe
2036	powershell.exe
2036	powershell.exe
3904	powershell.exe
3904	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3632	shutdown.exe
Token: SeRemoteShutdownPrivilege	3632	shutdown.exe
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: 36	920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	920	WMIC.exe
Token: SeSecurityPrivilege	920	WMIC.exe
Token: SeTakeOwnershipPrivilege	920	WMIC.exe
Token: SeLoadDriverPrivilege	920	WMIC.exe
Token: SeSystemProfilePrivilege	920	WMIC.exe
Token: SeSystemtimePrivilege	920	WMIC.exe
Token: SeProfSingleProcessPrivilege	920	WMIC.exe
Token: SeIncBasePriorityPrivilege	920	WMIC.exe
Token: SeCreatePagefilePrivilege	920	WMIC.exe
Token: SeBackupPrivilege	920	WMIC.exe
Token: SeRestorePrivilege	920	WMIC.exe
Token: SeShutdownPrivilege	920	WMIC.exe
Token: SeDebugPrivilege	920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	920	WMIC.exe
Token: SeRemoteShutdownPrivilege	920	WMIC.exe
Token: SeUndockPrivilege	920	WMIC.exe
Token: SeManageVolumePrivilege	920	WMIC.exe
Token: 33	920	WMIC.exe
Token: 34	920	WMIC.exe
Token: 35	920	WMIC.exe
Token: 36	920	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4204	WMIC.exe
Token: SeSecurityPrivilege	4204	WMIC.exe
Token: SeTakeOwnershipPrivilege	4204	WMIC.exe
Token: SeLoadDriverPrivilege	4204	WMIC.exe
Token: SeSystemProfilePrivilege	4204	WMIC.exe
Token: SeSystemtimePrivilege	4204	WMIC.exe
Token: SeProfSingleProcessPrivilege	4204	WMIC.exe
Token: SeIncBasePriorityPrivilege	4204	WMIC.exe
Token: SeCreatePagefilePrivilege	4204	WMIC.exe
Token: SeBackupPrivilege	4204	WMIC.exe
Token: SeRestorePrivilege	4204	WMIC.exe
Token: SeShutdownPrivilege	4204	WMIC.exe
Token: SeDebugPrivilege	4204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4204	WMIC.exe
Token: SeRemoteShutdownPrivilege	4204	WMIC.exe
Token: SeUndockPrivilege	4204	WMIC.exe
Token: SeManageVolumePrivilege	4204	WMIC.exe
Token: 33	4204	WMIC.exe
Token: 34	4204	WMIC.exe
Token: 35	4204	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2156	232	blackbird.exe	89
PID 232 wrote to memory of 2156	232	blackbird.exe	89
PID 2156 wrote to memory of 4668	2156	cmd.exe	90
PID 2156 wrote to memory of 4668	2156	cmd.exe	90
PID 2156 wrote to memory of 1972	2156	cmd.exe	91
PID 2156 wrote to memory of 1972	2156	cmd.exe	91
PID 2156 wrote to memory of 4700	2156	cmd.exe	92
PID 2156 wrote to memory of 4700	2156	cmd.exe	92
PID 2156 wrote to memory of 4836	2156	cmd.exe	93
PID 2156 wrote to memory of 4836	2156	cmd.exe	93
PID 2156 wrote to memory of 2212	2156	cmd.exe	94
PID 2156 wrote to memory of 2212	2156	cmd.exe	94
PID 2156 wrote to memory of 2216	2156	cmd.exe	95
PID 2156 wrote to memory of 2216	2156	cmd.exe	95
PID 2156 wrote to memory of 3632	2156	cmd.exe	96
PID 2156 wrote to memory of 3632	2156	cmd.exe	96
PID 2156 wrote to memory of 2060	2156	cmd.exe	97
PID 2156 wrote to memory of 2060	2156	cmd.exe	97
PID 2156 wrote to memory of 3560	2156	cmd.exe	98
PID 2156 wrote to memory of 3560	2156	cmd.exe	98
PID 3560 wrote to memory of 920	3560	cmd.exe	99
PID 3560 wrote to memory of 920	3560	cmd.exe	99
PID 3560 wrote to memory of 4464	3560	cmd.exe	100
PID 3560 wrote to memory of 4464	3560	cmd.exe	100
PID 2156 wrote to memory of 1616	2156	cmd.exe	102
PID 2156 wrote to memory of 1616	2156	cmd.exe	102
PID 2156 wrote to memory of 2044	2156	cmd.exe	103
PID 2156 wrote to memory of 2044	2156	cmd.exe	103
PID 2156 wrote to memory of 1196	2156	cmd.exe	104
PID 2156 wrote to memory of 1196	2156	cmd.exe	104
PID 2156 wrote to memory of 2556	2156	cmd.exe	105
PID 2156 wrote to memory of 2556	2156	cmd.exe	105
PID 2156 wrote to memory of 3976	2156	cmd.exe	107
PID 2156 wrote to memory of 3976	2156	cmd.exe	107
PID 2156 wrote to memory of 1348	2156	cmd.exe	108
PID 2156 wrote to memory of 1348	2156	cmd.exe	108
PID 1348 wrote to memory of 4608	1348	cmd.exe	109
PID 1348 wrote to memory of 4608	1348	cmd.exe	109
PID 1348 wrote to memory of 1580	1348	cmd.exe	110
PID 1348 wrote to memory of 1580	1348	cmd.exe	110
PID 1348 wrote to memory of 4052	1348	cmd.exe	111
PID 1348 wrote to memory of 4052	1348	cmd.exe	111
PID 2156 wrote to memory of 1632	2156	cmd.exe	112
PID 2156 wrote to memory of 1632	2156	cmd.exe	112
PID 2156 wrote to memory of 3212	2156	cmd.exe	113
PID 2156 wrote to memory of 3212	2156	cmd.exe	113
PID 2156 wrote to memory of 1716	2156	cmd.exe	114
PID 2156 wrote to memory of 1716	2156	cmd.exe	114
PID 1716 wrote to memory of 3536	1716	cmd.exe	115
PID 1716 wrote to memory of 3536	1716	cmd.exe	115
PID 1716 wrote to memory of 3992	1716	cmd.exe	116
PID 1716 wrote to memory of 3992	1716	cmd.exe	116
PID 2156 wrote to memory of 2308	2156	cmd.exe	118
PID 2156 wrote to memory of 2308	2156	cmd.exe	118
PID 2308 wrote to memory of 4204	2308	cmd.exe	119
PID 2308 wrote to memory of 4204	2308	cmd.exe	119
PID 2156 wrote to memory of 3664	2156	cmd.exe	121
PID 2156 wrote to memory of 3664	2156	cmd.exe	121
PID 2156 wrote to memory of 3468	2156	cmd.exe	122
PID 2156 wrote to memory of 3468	2156	cmd.exe	122
PID 2156 wrote to memory of 4972	2156	cmd.exe	123
PID 2156 wrote to memory of 4972	2156	cmd.exe	123
PID 2156 wrote to memory of 3372	2156	cmd.exe	124
PID 2156 wrote to memory of 3372	2156	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2740	attrib.exe
4204	attrib.exe
1392	attrib.exe
4800	attrib.exe

C:\Users\Admin\AppData\Local\Temp\blackbird.exe
"C:\Users\Admin\AppData\Local\Temp\blackbird.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat C:\Users\Admin\AppData\Local\Temp\blackbird.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo ;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;; "
    3⤵
    PID:4668
- - C:\Windows\system32\find.exe
    find /C /I "\system32;"
    3⤵
    PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo ;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;; "
    3⤵
    PID:4700
- - C:\Windows\system32\find.exe
    find /C /I "\wbem;"
    3⤵
    PID:4836
- - C:\Windows\system32\reg.exe
    reg add HKLM /F
    3⤵
    PID:2212
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2216
- - C:\Windows\system32\shutdown.exe
    shutdown /a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic /node:"ETDALPOV" COMPUTERSYSTEM GET USERNAME | findstr /i "ETDALPOV"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:"ETDALPOV" COMPUTERSYSTEM GET USERNAME
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\system32\findstr.exe
      findstr /i "ETDALPOV"
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo C:\Users\Admin\AppData\Local\Temp\blackbirds_temp "
    3⤵
    PID:1616
- - C:\Windows\system32\findstr.exe
    findstr /i ".*\\blackbirds_temp"
    3⤵
    PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps; "
    3⤵
    PID:1196
- - C:\Windows\system32\findstr.exe
    findstr /i "powershell"
    3⤵
    PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
    3⤵
    PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mode con|findstr /n "^"|findstr /l /b /c:"5:"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\system32\mode.com
      mode con
      4⤵
      PID:4608
  - - C:\Windows\system32\findstr.exe
      findstr /n "^"
      4⤵
      PID:1580
  - - C:\Windows\system32\findstr.exe
      findstr /l /b /c:"5:"
      4⤵
      PID:4052
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Control Panel\Desktop"
    3⤵
    PID:1632
- - C:\Windows\system32\findstr.exe
    findstr /ir "\<PreferredUILanguages.*REG_MULTI_SZ "
    3⤵
    PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\System\ControlSet001\Control\Nls\Language" /v "InstallLanguage" | findstr /ir "\<InstallLanguage.*REG_SZ "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\System\ControlSet001\Control\Nls\Language" /v "InstallLanguage"
      4⤵
      PID:3536
  - - C:\Windows\system32\findstr.exe
      findstr /ir "\<InstallLanguage.*REG_SZ "
      4⤵
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_useraccount where name='Admin' get sid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_useraccount where name='Admin' get sid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Program Files (x86)\" "
    3⤵
    PID:3664
- - C:\Windows\system32\findstr.exe
    findstr /irc:"NVIDIA Corporation"
    3⤵
    PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4972
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3372
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4804
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1728
- - C:\Windows\system32\findstr.exe
    findstr /a:06 /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2132
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:552
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:784
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3620
- - C:\Windows\system32\findstr.exe
    findstr /a:06 /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:3340
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:5092
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:1796
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:888
- - C:\Windows\system32\findstr.exe
    findstr /a:60 /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2900
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4036
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh interface ipv6 show route | findstr /rc:".* 1 .*\:.*\:.*\:.*/128 .* \:\:1$"
    3⤵
    PID:1448
  - - C:\Windows\system32\netsh.exe
      netsh interface ipv6 show route
      4⤵
      PID:4064
  - - C:\Windows\system32\findstr.exe
      findstr /rc:".* 1 .*\:.*\:.*\:.*/128 .* \:\:1$"
      4⤵
      PID:460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh interface ipv4 show route | findstr /rc:".* 1 .*[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/32 .* 127.0.0.0$" | findstr /r /v "0\.0\.0\.0"
    3⤵
    PID:1856
  - - C:\Windows\system32\netsh.exe
      netsh interface ipv4 show route
      4⤵
      PID:1580
  - - C:\Windows\system32\findstr.exe
      findstr /rc:".* 1 .*[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/32 .* 127.0.0.0$"
      4⤵
      PID:4608
  - - C:\Windows\system32\findstr.exe
      findstr /r /v "0\.0\.0\.0"
      4⤵
      PID:2972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /fo list
    3⤵
    PID:4924
- - C:\Windows\system32\findstr.exe
    findstr /vr ".*\\UpdateOrchestrator\\Schedule.*Scan$ .*\\USO_Broker_Display$ .*\\USO_UxBroker$ .*\\WinSAT$"
    3⤵
    PID:3328
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Agent Activation Runtime\\S-1-5-21-557049126-2506969350-2798870634-1000$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\Office 15 Subscription Heartbeat$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetry\\AgentFallBack$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4856
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetry\\AgentFallBack2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:380
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetry\\AgentLogOn$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1656
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetry\\OfficeTelemetryAgentLogOn2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1700
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetryAgentFallBack$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5004
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetryAgentFallBack2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3816
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetryAgentLogOn$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4252
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Office\\OfficeTelemetryAgentLogOn2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3844
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\AppID\\SmartScreenSpecific$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3388
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\AppID\\VerifiedPublisherCertStoreCheck$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Application Experience\\AitAgent$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2148
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Application Experience\\Microsoft Compatibility Appraiser$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3964
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Application Experience\\PcaPatchDbTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:676
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Application Experience\\ProgramDataUpdater$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4384
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Application Experience\\StartupAppTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4796
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\ApplicationData\\AppUriVerifierDaily$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\ApplicationData\\AppUriVerifierInstall$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\ApplicationData\\DsSvcCleanup$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2672
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Autochk\\Proxy$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2228
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\CloudExperienceHost\\CreateObjectTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Customer Experience Improvement Program\\BthSQM$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Customer Experience Improvement Program\\HypervisorFlightingTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Customer Experience Improvement Program\\KernelCeipTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Customer Experience Improvement Program\\Uploader$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1396
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Customer Experience Improvement Program\\UsbCeip$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4332
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Device Information\\Device$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1520
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Device Information\\Device User$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4772
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Device Setup\\Metadata Refresh$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1984
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Diagnosis\\RecommendedTroubleshootingScanner$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3184
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Diagnosis\\Scheduled$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4124
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\DiskDiagnostic\\Microsoft-Windows-DiskDiagnosticDataCollector$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4836
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\DiskDiagnostic\\Microsoft-Windows-DiskDiagnosticResolver$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4036
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\DiskFootprint\\Diagnostics$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2216
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\End Of Support\\Notify1$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4112
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\End Of Support\\Notify2$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3064
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\ErrorDetails\\EnableErrorDetailsUpdate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2720
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\ErrorDetails\\ErrorDetailsUpdate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2664
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Feedback\\Siuf\\DmClient$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1644
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Feedback\\Siuf\\DmClientOnScenarioDownload$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4052
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\FileHistory\\File History (maintenance mode)$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1580
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Flighting\\FeatureConfig\\ReconcileFeatures$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4640
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Flighting\\FeatureConfig\\UsageDataFlushing$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1124
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Flighting\\FeatureConfig\\UsageDataReporting$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Flighting\\OneSettings\\RefreshCache$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1732
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\IME\\SQM data sender$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3904
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Input\\LocalUserSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Input\\MouseSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1004
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Input\\PenSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2628
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Input\\TouchpadUserSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\LanguageComponentsInstaller\\Installation$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3372
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\LanguageComponentsInstaller\\ReconcileLanguageResources$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5004
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Location\\Notifications$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3816
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Maintenance\\WinSAT$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4252
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Management\\Provisioning\\Cellular$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3844
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Management\\Provisioning\\Logon$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3388
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\ActivateWindowsSearch$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\ConfigureInternetTimeService$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4852
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\DispatchRecoveryTasks$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:776
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\ehDRMInit$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:676
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\InstallPlayReady$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4384
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\mcupdate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\MediaCenterRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2620
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\ObjectStoreRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3652
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\OCURActivate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:556
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\OCURDiscovery$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2452
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\PBDADiscovery$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\PBDADiscoveryW1$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\PBDADiscoveryW2$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\PvrRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\PvrScheduleTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\RegisterSearch$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4468
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\ReindexSearchRoot$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4304
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\SqlLiteRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4460
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Media Center\\UpdateRecordPath$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1972
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Mobile Broadband Accounts\\MNO Metadata Parser$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\NetTrace\\GatherNetworkInfo$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4008
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\NlaSvc\\WiFiTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4836
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\PerfTrack\\BackgroundConfigSurveyor$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4036
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\PI\\Sqm-Tasks$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2216
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Power Efficiency Diagnostics\\AnalyzeSystem$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4112
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\PushToInstall\\LoginCheck$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3064
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\PushToInstall\\Registration$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3696
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\RemoteAssistance\\RemoteAssistanceTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3092
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\RemovalTools\\MRT_ERROR_HB$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1348
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\SettingSync\\BackgroundUploadTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4052
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\SettingSync\\BackupTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1704
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\SettingSync\\NetworkStateChangeTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1392
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\EOSNotify$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3932
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\EOSNotify2$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\gwx\\launchtrayprocess$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1732
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\gwx\\refreshgwxconfig$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2192
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\gwx\\refreshgwxconfigandcontent$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\Logon-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1004
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\Logon-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3664
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\MachineUnlock-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4072
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\MachineUnlock-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3372
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfIdle-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5004
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfIdle-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2204
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfSleep-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2364
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfSleep-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2648
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\refreshgwxconfig-B$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4208
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\Telemetry-4xd$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4556
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\Time-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2132
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Setup\\GWXTriggers\\Time-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5028
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Shell\\CreateObjectTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4920
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Shell\\FamilySafetyMonitor$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Shell\\FamilySafetyMonitorToastTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:212
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Shell\\FamilySafetyRefresh$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4924
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Shell\\FamilySafetyRefreshTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2228
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Shell\\FamilySafetyUpload$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2452
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\SideShow\\SessionAgent$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\SideShow\\SystemDataProviders$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Speech\\SpeechModelDownloadTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Maintenance Install$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5092
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Reboot$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4396
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_AC$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4176
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_Battery$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:888
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Report policies$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4480
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Report policies"
    3⤵
    PID:4700
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Maintenance Work$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1456
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work"
    3⤵
    PID:3912
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:996
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4684
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3348
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"
    3⤵
    PID:2664
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:5040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Wake To Work$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1348
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work"
    3⤵
    PID:4052
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:4640
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Work$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1392
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work"
    3⤵
    PID:2656
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_Broker_Display$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4204
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_RebootDisplay$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2308
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2504
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker_Display$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2628
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker_ReadyToReboot$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2188
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker_WnfDisplay$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4216
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\USO_WnfDisplay$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5004
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UpdateOrchestrator\\UpdateModelTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1728
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask"
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:2148
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\UPnP\\UPnPHostConfig$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1556
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\User Profile Service\\HiveUploadTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:212
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\WaaSMedic\\PerformRemediation$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2452
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\WCM\\WiFiTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\Windows Error Reporting\\QueueReporting$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4468
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\WindowsUpdate\\sih$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1896
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\Windows\\WlanSvc\\CDSSync$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4156
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\XblGameSave\\XblGameSaveTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3184
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\Microsoft\\XblGameSave\\XblGameSaveTaskLogon$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2212
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\OneDrive Standalone Update Task-S-1-5-21-557049126-2506969350-2798870634-1000$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2552
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3588
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmRep$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4232
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:996
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmRepCR1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4684
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmRepCR2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3348
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmRepCR3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2740
- - C:\Windows\system32\findstr.exe
    findstr /irc:" \\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1952
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1124
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\AarSvc$"
    3⤵
    PID:1856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\AarSvc
    3⤵
    PID:3932
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1392
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1732
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\AeLookupSvc$"
    3⤵
    PID:3968
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1656
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\BcastDVRUserService$"
    3⤵
    PID:2308
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\BcastDVRUserService
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4072
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:2088
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\BluetoothUserService$"
    3⤵
    PID:3816
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\BluetoothUserService
    3⤵
    PID:3844
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1728
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CaptureService$"
    3⤵
    PID:2148
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\CaptureService
    3⤵
    PID:4492
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1576
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\cbdhsvc$"
    3⤵
    PID:4432
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\cbdhsvc
    3⤵
    PID:3292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4304
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1896
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CDPSvc$"
    3⤵
    PID:1972
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\CDPSvc
    3⤵
    PID:3184
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4700
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2552
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CDPUserSvc$"
    3⤵
    PID:4036
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\CDPUserSvc
    3⤵
    PID:4232
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4112
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1228
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\cldflt$"
    3⤵
    PID:3092
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\cldflt
    3⤵
    PID:3516
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:5040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1952
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\ConsentUxUserSvc$"
    3⤵
    PID:2644
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ConsentUxUserSvc
    3⤵
    PID:1124
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3932
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CredentialEnrollmentManagerUserSvc$"
    3⤵
    PID:1392
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc
    3⤵
    PID:4528
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4956
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2724
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DcpSvc$"
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3488
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DeviceAssociationBrokerSvc$"
    3⤵
    PID:468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DeviceAssociationBrokerSvc
    3⤵
    PID:968
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1004
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DeviceAssociationService$"
    3⤵
    PID:3664
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DeviceAssociationService
    3⤵
    PID:2188
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3112
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4072
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DevicePickerUserSvc$"
    3⤵
    PID:3372
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DevicePickerUserSvc
    3⤵
    PID:4804
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1232
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DevicesFlowUserSvc$"
    3⤵
    PID:3796
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DevicesFlowUserSvc
    3⤵
    PID:1556
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:2452
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1368
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\diagnosticshub.standardcollector.service$"
    3⤵
    PID:4292
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\diagnosticshub.standardcollector.service
    3⤵
    PID:5092
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4460
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4176
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\diagsvc$"
    3⤵
    PID:2844
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\diagsvc
    3⤵
    PID:1896
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DiagTrack$"
    3⤵
    PID:3184
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DiagTrack
    3⤵
    PID:3588
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:2552
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3432
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DmWapPushService$"
    3⤵
    PID:1832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DmWapPushService
    3⤵
    PID:1332
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4448
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3052
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DoSvc$"
    3⤵
    PID:4232
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DoSvc
    3⤵
    PID:4684
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1228
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2740
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DPS$"
    3⤵
    PID:3516
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DPS
    3⤵
    PID:3412
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3108
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4052
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DsSvc$"
    3⤵
    PID:1952
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\DsSvc
    3⤵
    PID:2656
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2804
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\fdPHost$"
    3⤵
    PID:3932
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\fdPHost
    3⤵
    PID:1536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4528
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:5012
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\FDResPub$"
    3⤵
    PID:2724
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\FDResPub
    3⤵
    PID:1224
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3488
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\HPTouchpointAnalyticsService$"
    3⤵
    PID:968
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:2504
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\IEEtwCollectorService$"
    3⤵
    PID:1004
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4136
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\InstallService$"
    3⤵
    PID:2188
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\InstallService
    3⤵
    PID:4216
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4072
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4456
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\iphlpsvc$"
    3⤵
    PID:4804
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc
    3⤵
    PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3376
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:976
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\lanmanserver$"
    3⤵
    PID:884
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver
    3⤵
    PID:3340
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1368
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:4396
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\lfsvc$"
    3⤵
    PID:5092
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\lfsvc
    3⤵
    PID:4304
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4176
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4008
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\lmhosts$"
    3⤵
    PID:1896
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\lmhosts
    3⤵
    PID:4700
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4624
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\LxpSvc$"
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LxpSvc
    3⤵
    PID:2224
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4340
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2720
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\MessagingService$"
    3⤵
    PID:3064
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\MessagingService
    3⤵
    - Modifies registry key
    PID:1644
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3696
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1348
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\MRxDAV$"
    3⤵
    PID:3564
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\MRxDAV
    3⤵
    PID:3516
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3108
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\MRxSMB10$"
    3⤵
    PID:2644
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1952
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\NcaSvc$"
    3⤵
    PID:2840
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\NcaSvc
    3⤵
    PID:2128
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1192
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4620
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\NcbService$"
    3⤵
    PID:3540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\NcbService
    3⤵
    PID:1056
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3636
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:380
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\NetBT$"
    3⤵
    PID:2192
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\NetBT
    3⤵
    PID:4880
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:2308
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\NetMsmqActivator$"
    3⤵
    PID:5056
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\OneSyncSvc$"
    3⤵
    PID:2088
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc
    3⤵
    PID:3964
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2116
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\PcaSvc$"
    3⤵
    PID:3388
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\PcaSvc
    3⤵
    - Modifies registry key
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3652
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:212
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\PimIndexMaintenanceSvc$"
    3⤵
    PID:4928
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc
    3⤵
    PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4292
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4460
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\PrintWorkflowUserSvc$"
    3⤵
    PID:3292
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\PrintWorkflowUserSvc
    3⤵
    PID:4176
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4564
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1896
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\PushToInstall$"
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\PushToInstall
    3⤵
    PID:3184
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3588
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:5112
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\RemoteAccess$"
    3⤵
    PID:3432
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess
    3⤵
    PID:4988
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4112
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:996
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\RemoteRegistry$"
    3⤵
    PID:2920
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
    3⤵
    PID:3052
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1644
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1228
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\RetailDemo$"
    3⤵
    PID:1348
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\RetailDemo
    3⤵
    PID:3516
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3108
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\sgrmbroker$"
    3⤵
    PID:2644
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sgrmbroker
    3⤵
    PID:2840
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3648
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1192
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\shpamsvc$"
    3⤵
    PID:2320
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\shpamsvc
    3⤵
    PID:2556
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:468
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\SmsRouter$"
    3⤵
    PID:1732
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\SmsRouter
    3⤵
    PID:4972
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3488
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3664
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\srv$"
    3⤵
    PID:2504
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3112
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\SSDPSRV$"
    3⤵
    PID:4136
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRV
    3⤵
    PID:4048
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1232
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3844
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\StorSvc$"
    3⤵
    PID:2116
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\StorSvc
    3⤵
    PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1556
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\telemetry$"
    3⤵
    PID:212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\telemetry
    3⤵
    PID:1396
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4432
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4396
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\TrkWks$"
    3⤵
    PID:1540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\TrkWks
    3⤵
    PID:3020
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:2968
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3912
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\tunnel$"
    3⤵
    PID:3276
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\tunnel
    3⤵
    PID:3588
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1332
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\UevAgentService$"
    3⤵
    PID:4448
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\UevAgentService
    3⤵
    PID:3064
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:996
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:5040
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\UnistoreSvc$"
    3⤵
    PID:2972
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\UnistoreSvc
    3⤵
    PID:1228
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1348
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3516
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\upnphost$"
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\upnphost
    3⤵
    PID:4300
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1980
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:2128
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\UserDataSvc$"
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\UserDataSvc
    3⤵
    PID:4756
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1192
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3940
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\VDWFP$"
    3⤵
    PID:2556
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:468
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\VisualDiscovery$"
    3⤵
    PID:4892
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1700
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\W32Time$"
    3⤵
    PID:4972
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1460
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WaaSMedicSvc$"
    3⤵
    PID:1384
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc
    3⤵
    PID:3964
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4456
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\wcncsvc$"
    3⤵
    PID:976
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wcncsvc
    3⤵
    PID:3792
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:2212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4176
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WdiServiceHost$"
    3⤵
    PID:4036
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WdiServiceHost
    3⤵
    PID:2216
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4484
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3276
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WdiSystemHost$"
    3⤵
    PID:4844
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WdiSystemHost
    3⤵
    PID:5112
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4340
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2720
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WebClient$"
    3⤵
    PID:3092
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WebClient
    3⤵
    PID:4232
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3064
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:3052
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\wercplsupport$"
    3⤵
    PID:4672
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wercplsupport
    3⤵
    PID:1592
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1228
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2008
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WerSvc$"
    3⤵
    PID:1952
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WerSvc
    3⤵
    PID:4640
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:472
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1980
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WinHttpAutoProxySvc$"
    3⤵
    PID:4356
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
    3⤵
    PID:2128
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4756
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WinRM$"
    3⤵
    PID:1192
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WinRM
    3⤵
    PID:1224
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4204
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\wisvc$"
    3⤵
    PID:1656
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wisvc
    3⤵
    PID:2772
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4880
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3664
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\wlidsvc$"
    3⤵
    PID:2188
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc
    3⤵
    PID:4804
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3376
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WMPNetworkSvc$"
    3⤵
    PID:1576
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc
    3⤵
    PID:4396
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4564
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3020
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WpnService$"
    3⤵
    PID:4176
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WpnService
    3⤵
    PID:4368
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4900
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3456
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\WpnUserService$"
    3⤵
    PID:3432
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService
    3⤵
    PID:3588
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4440
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3752
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\xbgm$"
    3⤵
    PID:1580
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1332
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\XblAuthManager$"
    3⤵
    PID:4684
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\XblAuthManager
    3⤵
    PID:3696
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3716
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2972
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\XblGameSave$"
    3⤵
    PID:1644
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\XblGameSave
    3⤵
    PID:3904
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:3516
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2644
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\XboxGipSvc$"
    3⤵
    PID:4300
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\XboxGipSvc
    3⤵
    PID:1980
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4356
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2128
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\XboxNetApiSvc$"
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\XboxNetApiSvc
    3⤵
    PID:1192
- - C:\Windows\system32\findstr.exe
    findstr /irc:" start .*REG_DWORD .*0x[0-3]$"
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4204
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\NvTelemetryContainer$"
    3⤵
    PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger" | findstr /v "ReadyBoot Defender EventLog- Status" | findstr /i ".*\\WMI\\Autologger\\.*"
    3⤵
    PID:1004
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger"
      4⤵
      PID:1460
  - - C:\Windows\system32\findstr.exe
      findstr /v "ReadyBoot Defender EventLog- Status"
      4⤵
      PID:3664
  - - C:\Windows\system32\findstr.exe
      findstr /i ".*\\WMI\\Autologger\\.*"
      4⤵
      PID:2188
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Cellcore"
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:884
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger"
    3⤵
    PID:1576
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:1540
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\CloudExperienceHostOobe"
    3⤵
    PID:4036
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3316
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DataMarket"
    3⤵
    PID:2216
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2868
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DiagLog"
    3⤵
    PID:744
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3456
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Diagtrack-Listener"
    3⤵
    PID:4340
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\HolographicDevice"
    3⤵
    PID:1564
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:4232
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\LwtNetLog"
    3⤵
    PID:4672
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3052
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Mellanox-Kernel"
    3⤵
    PID:1952
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2804
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Microsoft-Windows-AssignedAccess-Trace"
    3⤵
    PID:3648
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:1584
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace"
    3⤵
    PID:3096
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:1536
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Microsoft-Windows-Setup"
    3⤵
    PID:2040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2496
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NBSMBLOGGER"
    3⤵
    PID:2192
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3940
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NetCore"
    3⤵
    PID:2088
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:4972
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NtfsLog"
    3⤵
    PID:2308
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3968
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\PEAuthLog"
    3⤵
    PID:3964
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:4556
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\RadioMgr"
    3⤵
    PID:2504
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2188
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\RdrLog"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2812
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SetupPlatform"
    3⤵
    PID:3292
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2212
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SetupPlatformTel"
    3⤵
    PID:2772
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2552
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SpoolerLogger"
    3⤵
    PID:4504
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2076
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger"
    3⤵
    PID:3432
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:1832
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\TCPIPLOGGER"
    3⤵
    PID:3276
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:5112
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\TileStore"
    3⤵
    PID:4440
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:4624
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Tpm"
    3⤵
    PID:4988
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3696
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\UBPM"
    3⤵
    PID:4232
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2144
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog"
    3⤵
    PID:4672
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:3052
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WFP-IPsec Trace"
    3⤵
    PID:3108
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:472
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WiFiDriverIHVSession"
    3⤵
    PID:4300
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:1980
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WiFiDriverIHVSessionRepro"
    3⤵
    PID:1536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:4420
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WiFiSession"
    3⤵
    PID:2556
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:2724
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WinPhoneCritical"
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x1$"
    3⤵
    PID:1700
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo
    3⤵
    PID:4204
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Id .*REG_SZ .*null$"
    3⤵
    PID:1384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:1460
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3664
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:1368
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3792
- - C:\Windows\system32\findstr.exe
    findstr /a:4f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4176
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4036
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2224
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3456
- - C:\Windows\system32\findstr.exe
    findstr /a:4f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4340
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3752
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:1392
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2144
- - C:\Windows\system32\findstr.exe
    findstr /a:4f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2840
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4620
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2040
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1124
- - C:\Windows\system32\findstr.exe
    findstr /a:4f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2724
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:468
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4208
- - C:\Windows\system32\findstr.exe
    findstr /a:0f "." "/.\'" nul
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:3664
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4768
- - C:\Windows\system32\findstr.exe
    findstr /a:4f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2212
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4112
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2868
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2216
- - C:\Windows\system32\findstr.exe
    findstr /a:0c /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:1832
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4684
- - C:\Windows\system32\findstr.exe
    findstr /a:0e /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4624
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4988
- - C:\Windows\system32\findstr.exe
    findstr /a:0c /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4640
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3108
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:1980
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
    3⤵
    PID:1732
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x4$"
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
    3⤵
    PID:1192
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Start .*REG_DWORD .*0x[1-3]$"
    3⤵
    PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2088
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1700
- - C:\Windows\system32\findstr.exe
    findstr /a:02 /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:3620
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr /a:0c /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2924
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1408
- - C:\Windows\system32\findstr.exe
    findstr /a:0e /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:3304
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4484
- - C:\Windows\system32\findstr.exe
    findstr /a:0c /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2552
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4504
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:3432
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3456
- - C:\Windows\system32\findstr.exe
    findstr /a:4f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4440
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2232
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2008
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3536
- - C:\Windows\system32\findstr.exe
    findstr /a:3f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4856
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4420
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:2724
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:4208
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /a:06 /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem"
    3⤵
    PID:976
- - C:\Windows\system32\subst.exe
    subst ': "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4744
- - C:\Windows\system32\findstr.exe
    findstr /a:0f /f:C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp "."
    3⤵
    PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c xcopy /L /w "C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat" "C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat" 2>NUL
    3⤵
    PID:4124
  - - C:\Windows\system32\xcopy.exe
      xcopy /L /w "C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat" "C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat"
      4⤵
      PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat" nul /z
    3⤵
    PID:472
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\upfc.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3108
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*System.*(RX)"
    3⤵
    PID:4580
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\system32\upfc.exe" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4856
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\upfc.exe" /grant:r system:r /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2040
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\upfc.exe" /grant:r "nt service\trustedinstaller:r" /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4212
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\upfc.exe" /grant:r *S-1-5-32-544:f /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2312
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\upfc.exe" /setowner "nt service\trustedinstaller" /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2144
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\upfc.exe" /grant:r *S-1-5-32-544:r /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1700
- - C:\Windows\system32\attrib.exe
    attrib -s -h -r /S /D "C:\Program Files\WindowsApps"
    3⤵
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:4204
- - C:\Windows\system32\attrib.exe
    attrib -s -h -r /S /D "C:\Users\Admin\AppData\Local\Packages"
    3⤵
    - Views/modifies file attributes
    PID:1392
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5040
- - C:\Windows\system32\findstr.exe
    findstr /irc:"ETDALPOV.*Admin.*(F)"
    3⤵
    PID:3008
- - C:\Windows\system32\attrib.exe
    attrib -h /D "C:\Program Files\WindowsApps"
    3⤵
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:4800
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps" /grant:r *S-1-5-32-544:f /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2064
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\Packages"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3368
- - C:\Windows\system32\findstr.exe
    findstr /irc:"ETDALPOV.*Admin.*(F)"
    3⤵
    PID:1036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /a:d /b "C:\Users\Admin\AppData\Local\Packages" | findstr /i ".*Advertising.*" | findstr /iv ".*BlackbirdBackup"
    3⤵
    PID:3020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /a:d /b "C:\Users\Admin\AppData\Local\Packages" "
      4⤵
      PID:4176
  - - C:\Windows\system32\findstr.exe
      findstr /i ".*Advertising.*"
      4⤵
      PID:4108
  - - C:\Windows\system32\findstr.exe
      findstr /iv ".*BlackbirdBackup"
      4⤵
      PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /a:d /b "C:\Program Files\WindowsApps" | findstr /i ".*Advertising.*" | findstr /iv ".*BlackbirdBackup"
    3⤵
    PID:4796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /a:d /b "C:\Program Files\WindowsApps" "
      4⤵
      PID:3432
  - - C:\Windows\system32\findstr.exe
      findstr /i ".*Advertising.*"
      4⤵
      PID:744
  - - C:\Windows\system32\findstr.exe
      findstr /iv ".*BlackbirdBackup"
      4⤵
      PID:1332
- - C:\Windows\system32\attrib.exe
    attrib -h /D /S "C:\Program Files\WindowsApps"
    3⤵
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:2740
- - C:\Windows\system32\takeown.exe
    takeown /a /f "C:\Program Files\WindowsApps"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1544
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps" /grant:r *S-1-5-32-544:f /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" | findstr /i ".*\.exe"
    3⤵
    PID:1516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" "
      4⤵
      PID:3752
  - - C:\Windows\system32\findstr.exe
      findstr /i ".*\.exe"
      4⤵
      PID:5112
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /a /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3292
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /grant:r *S-1-5-32-544:f /T /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3716
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /remove:g SYSTEM /inheritance:r /deny "SYSTEM:(OI)(CI)(IO)(F)" /T /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4684
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /remove TrustedInstaller /T /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4868
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /remove "ALL RESTRICTED APPLICATION PACKAGES" /T /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1636
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /remove "ALL APPLICATION PACKAGES" /T /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1280
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe" /remove "APPLICATION PACKAGE AUTHORITY" /T /C /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4124
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM searchUI.exe
    3⤵
    - Kills process with taskkill
    PID:472
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser_broker.exe
    3⤵
    - Kills process with taskkill
    PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker.exe
    3⤵
    - Kills process with taskkill
    PID:1192
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RemindersServer.exe
    3⤵
    - Kills process with taskkill
    PID:1952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM backgroundTaskHost.exe
    3⤵
    - Kills process with taskkill
    PID:4588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:3620
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MicrosoftEdge.exe
    3⤵
    - Kills process with taskkill
    PID:1104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MicrosoftEdgeCP.exe
    3⤵
    - Kills process with taskkill
    PID:3404
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MicrosoftEdgeSH.exe
    3⤵
    - Kills process with taskkill
    PID:2148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MicrosoftEdgeBCHost.exe
    3⤵
    - Kills process with taskkill
    PID:4036
- - C:\Windows\system32\schtasks.exe
    schtasks /query /fo list
    3⤵
    PID:2060
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Agent Activation Runtime\\S-1-5-21-557049126-2506969350-2798870634-1000$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2908
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\Office 15 Subscription Heartbeat$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4760
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetry\\AgentFallBack$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3252
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetry\\AgentFallBack2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3696
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetry\\AgentLogOn$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:976
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetry\\OfficeTelemetryAgentLogOn2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4744
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetryAgentFallBack$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3648
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetryAgentFallBack2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1864
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetryAgentLogOn$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1816
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Office\\OfficeTelemetryAgentLogOn2016$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1004
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\AppID\\SmartScreenSpecific$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3656
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\AppID\\VerifiedPublisherCertStoreCheck$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:236
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Application Experience\\AitAgent$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2868
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Application Experience\\Microsoft Compatibility Appraiser$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3912
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Application Experience\\PcaPatchDbTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4564
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Application Experience\\ProgramDataUpdater$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2660
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Application Experience\\StartupAppTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2944
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\ApplicationData\\AppUriVerifierDaily$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2772
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\ApplicationData\\AppUriVerifierInstall$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5000
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\ApplicationData\\DsSvcCleanup$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5092
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Autochk\\Proxy$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:920
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\CloudExperienceHost\\CreateObjectTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1720
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Customer Experience Improvement Program\\BthSQM$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3276
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2120
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Customer Experience Improvement Program\\HypervisorFlightingTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4896
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Customer Experience Improvement Program\\KernelCeipTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1256
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Customer Experience Improvement Program\\Uploader$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2836
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Customer Experience Improvement Program\\UsbCeip$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1852
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Device Information\\Device$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1080
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Device Information\\Device User$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5112
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Device Setup\\Metadata Refresh$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1564
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Diagnosis\\RecommendedTroubleshootingScanner$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2792
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Diagnosis\\Scheduled$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5032
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\DiskDiagnostic\\Microsoft-Windows-DiskDiagnosticDataCollector$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4684
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\DiskDiagnostic\\Microsoft-Windows-DiskDiagnosticResolver$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2820
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\DiskFootprint\\Diagnostics$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1896
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\End Of Support\\Notify1$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4428
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\End Of Support\\Notify2$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3536
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\ErrorDetails\\EnableErrorDetailsUpdate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2900
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\ErrorDetails\\ErrorDetailsUpdate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2496
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Feedback\\Siuf\\DmClient$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3064
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Feedback\\Siuf\\DmClientOnScenarioDownload$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4420
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\FileHistory\\File History (maintenance mode)$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2304
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Flighting\\FeatureConfig\\ReconcileFeatures$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3852
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Flighting\\FeatureConfig\\UsageDataFlushing$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3564
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Flighting\\FeatureConfig\\UsageDataReporting$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2956
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Flighting\\OneSettings\\RefreshCache$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5060
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\IME\\SQM data sender$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4876
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Input\\LocalUserSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:416
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Input\\MouseSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2968
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Input\\PenSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1836
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Input\\TouchpadUserSyncDataAvailable$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5084
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\LanguageComponentsInstaller\\Installation$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4892
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\LanguageComponentsInstaller\\ReconcileLanguageResources$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1388
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Location\\Notifications$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2500
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Maintenance\\WinSAT$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3736
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Management\\Provisioning\\Cellular$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4856
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Management\\Provisioning\\Logon$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2144
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\ActivateWindowsSearch$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4324
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\ConfigureInternetTimeService$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4588
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\DispatchRecoveryTasks$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2436
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\ehDRMInit$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3932
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\InstallPlayReady$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1364
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\mcupdate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2904
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\MediaCenterRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\ObjectStoreRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:220
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\OCURActivate$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2320
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\OCURDiscovery$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3304
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\PBDADiscovery$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4652
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\PBDADiscoveryW1$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3904
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\PBDADiscoveryW2$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3408
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\PvrRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4800
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\PvrScheduleTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4664
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\RegisterSearch$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2064
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\ReindexSearchRoot$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3936
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\SqlLiteRecoveryTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1368
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Media Center\\UpdateRecordPath$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4376
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Mobile Broadband Accounts\\MNO Metadata Parser$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1976
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\NetTrace\\GatherNetworkInfo$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4388
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\NlaSvc\\WiFiTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1448
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\PerfTrack\\BackgroundConfigSurveyor$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3344
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\PI\\Sqm-Tasks$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3624
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Power Efficiency Diagnostics\\AnalyzeSystem$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4108
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\PushToInstall\\LoginCheck$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3576
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\PushToInstall\\Registration$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1832
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\RemoteAssistance\\RemoteAssistanceTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4000
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\RemovalTools\\MRT_ERROR_HB$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\SettingSync\\BackgroundUploadTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2224
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\SettingSync\\BackupTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4076
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\SettingSync\\NetworkStateChangeTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:948
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\EOSNotify$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4600
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\EOSNotify2$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2740
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\gwx\\launchtrayprocess$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2384
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\gwx\\refreshgwxconfig$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1860
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\gwx\\refreshgwxconfigandcontent$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1796
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\Logon-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4896
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\Logon-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1568
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\MachineUnlock-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1960
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\MachineUnlock-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2948
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfIdle-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3752
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfIdle-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfSleep-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4232
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\OutOfSleep-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2940
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\refreshgwxconfig-B$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4380
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\Telemetry-4xd$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4624
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\Time-10s$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2024
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Setup\\GWXTriggers\\Time-5d$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4964
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Shell\\CreateObjectTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4640
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Shell\\FamilySafetyMonitor$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4124
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Shell\\FamilySafetyMonitorToastTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:756
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Shell\\FamilySafetyRefresh$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4988
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Shell\\FamilySafetyRefreshTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2040
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Shell\\FamilySafetyUpload$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4420
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\SideShow\\SessionAgent$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3876
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\SideShow\\SystemDataProviders$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4912
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Speech\\SpeechModelDownloadTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2084
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Maintenance Install$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:60
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Reboot$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2036
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_AC$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:5108
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_Battery$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4740
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Report policies$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:404
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Report policies"
    3⤵
    PID:1136
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:5084
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "\Microsoft\Windows\UpdateOrchestrator\Report policies"
    3⤵
    PID:3756
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Report policies" /Disable
    3⤵
    PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Disable-ScheduledTask -TaskName 'Report policies' -TaskPath '\Microsoft\Windows\UpdateOrchestrator\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Maintenance Work$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2248
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work"
    3⤵
    PID:1392
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:3516
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3008
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"
    3⤵
    PID:4800
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:3544
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"
    3⤵
    PID:4344
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
    3⤵
    PID:2104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Disable-ScheduledTask -TaskName 'Schedule Scan' -TaskPath '\Microsoft\Windows\UpdateOrchestrator\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:632
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"
    3⤵
    PID:3388
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:4608
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"
    3⤵
    PID:924
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
    3⤵
    PID:3652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Disable-ScheduledTask -TaskName 'Schedule Scan Static Task' -TaskPath '\Microsoft\Windows\UpdateOrchestrator\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Wake To Work$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4380
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work"
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:2024
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Work$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4640
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work"
    3⤵
    PID:3536
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:3372
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_Broker_Display$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4356
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_RebootDisplay$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2624
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3488
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker"
    3⤵
    PID:4420
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:3852
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker"
    3⤵
    PID:64
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
    3⤵
    PID:3864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Disable-ScheduledTask -TaskName 'USO_UxBroker' -TaskPath '\Microsoft\Windows\UpdateOrchestrator\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker_Display$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2904
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker_ReadyToReboot$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1824
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker_WnfDisplay$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\USO_WnfDisplay$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4208
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UpdateOrchestrator\\UpdateModelTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2872
- - C:\Windows\system32\schtasks.exe
    schtasks /query /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask"
    3⤵
    PID:3720
- - C:\Windows\system32\findstr.exe
    findstr /irc:" Disabled .*$"
    3⤵
    PID:3468
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask"
    3⤵
    PID:3304
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask" /Disable
    3⤵
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Disable-ScheduledTask -TaskName 'UpdateModelTask' -TaskPath '\Microsoft\Windows\UpdateOrchestrator\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3904
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\UPnP\\UPnPHostConfig$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:236
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\User Profile Service\\HiveUploadTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:744
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\WaaSMedic\\PerformRemediation$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4292
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\WCM\\WiFiTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2772
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1912
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\Windows Error Reporting\\QueueReporting$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4844
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2808
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\WindowsUpdate\\sih$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1052
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\Windows\\WlanSvc\\CDSSync$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1980
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\XblGameSave\\XblGameSaveTask$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:632
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\Microsoft\\XblGameSave\\XblGameSaveTaskLogon$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:4600
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\OneDrive Standalone Update Task-S-1-5-21-557049126-2506969350-2798870634-1000$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3388
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:924
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmRep$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3652
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1792
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmRepCR1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3444
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmRepCR2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:1576
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmRepCR3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:3312
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\:.* \\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}$" "C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp"
    3⤵
    PID:2396
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1860
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\AarSvc$"
    3⤵
    PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo AarSvc "
    3⤵
    PID:1564
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" AarSvc_.*"
    3⤵
    PID:4684
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:4624
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" AarSvc_.*"
      4⤵
      PID:1636
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1280
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\AeLookupSvc$"
    3⤵
    PID:3540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:380
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\BcastDVRUserService$"
    3⤵
    PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo BcastDVRUserService "
    3⤵
    PID:2792
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" BcastDVRUserService_.*"
    3⤵
    PID:3488
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      Launches sc.exe
      PID:3180
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" BcastDVRUserService_.*"
      4⤵
      PID:4912
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:4360
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\BluetoothUserService$"
    3⤵
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo BluetoothUserService "
    3⤵
    PID:2724
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" BluetoothUserService_.*"
    3⤵
    PID:3756
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:1132
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" BluetoothUserService_.*"
      4⤵
      PID:2500
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3760
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CaptureService$"
    3⤵
    PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CaptureService "
    3⤵
    PID:1136
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" CaptureService_.*"
    3⤵
    PID:2036
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:5036
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" CaptureService_.*"
      4⤵
      PID:3736
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4208
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\cbdhsvc$"
    3⤵
    PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo cbdhsvc "
    3⤵
    PID:2248
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" cbdhsvc_.*"
    3⤵
    PID:4768
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      Launches sc.exe
      PID:1220
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" cbdhsvc_.*"
      4⤵
      PID:2064
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:1456
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CDPSvc$"
    3⤵
    PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CDPSvc "
    3⤵
    PID:3012
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:2992
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:2772
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CDPUserSvc$"
    3⤵
    PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CDPUserSvc "
    3⤵
    PID:4844
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" CDPUserSvc_.*"
    3⤵
    PID:1052
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:5092
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" CDPUserSvc_.*"
      4⤵
      PID:920
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4568
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\cldflt$"
    3⤵
    PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo cldflt "
    3⤵
    PID:924
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:2364
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:1792
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\ConsentUxUserSvc$"
    3⤵
    PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo ConsentUxUserSvc "
    3⤵
    PID:3612
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" ConsentUxUserSvc_.*"
    3⤵
    PID:3312
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      Launches sc.exe
      PID:2396
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" ConsentUxUserSvc_.*"
      4⤵
      PID:4796
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3752
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\CredentialEnrollmentManagerUserSvc$"
    3⤵
    PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo CredentialEnrollmentManagerUserSvc "
    3⤵
    PID:640
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" CredentialEnrollmentManagerUserSvc_.*"
    3⤵
    PID:4380
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:3856
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" CredentialEnrollmentManagerUserSvc_.*"
      4⤵
      PID:4868
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3000
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DcpSvc$"
    3⤵
    PID:3176
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:3540
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DeviceAssociationBrokerSvc$"
    3⤵
    PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo DeviceAssociationBrokerSvc "
    3⤵
    PID:2900
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" DeviceAssociationBrokerSvc_.*"
    3⤵
    PID:472
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:4420
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" DeviceAssociationBrokerSvc_.*"
      4⤵
      PID:3180
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:64
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DeviceAssociationService$"
    3⤵
    PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo DeviceAssociationService "
    3⤵
    PID:404
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:2088
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    - Modifies registry key
    PID:4528
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DevicePickerUserSvc$"
    3⤵
    PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo DevicePickerUserSvc "
    3⤵
    PID:560
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:2500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" DevicePickerUserSvc_.*"
    3⤵
    PID:4404
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      Launches sc.exe
      PID:5016
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" DevicePickerUserSvc_.*"
      4⤵
      PID:1836
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4212
- - C:\Windows\system32\findstr.exe
    findstr /irc:".*\\services\\DevicesFlowUserSvc$"
    3⤵
    PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo DevicesFlowUserSvc "
    3⤵
    PID:2904
- - C:\Windows\system32\findstr.exe
    findstr /i "AarSvc BcastDVRUserService BluetoothUserService CaptureService cbdhsvc ConsentUxUserSvc CredentialEnrollmentManagerUserSvc DeviceAssociationBrokerSvc DevicePickerUserSvc PimIndexMaintenanceSvc PrintWorkflowUserSvc MessagingService CDPUserSvc DevicesFlowUserSvc OneSyncSvc UnistoreSvc UserDataSvc WpnUserService"
    3⤵
    PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex state= all | findstr /irc:" DevicesFlowUserSvc_.*"
    3⤵
    PID:1364
  - - C:\Windows\system32\sc.exe
      sc queryex state= all
      4⤵
      PID:5056
  - - C:\Windows\system32\findstr.exe
      findstr /irc:" DevicesFlowUserSvc_.*"
      4⤵
      PID:4652
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services
    3⤵
    PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\'
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5D45.bat

Path C:\Users\Admin\AppData\Local\Temp\5D43.tmp\5D44.tmp\5D45.bat
Size 525KB
SHA256 9ed136a0badeae075bb4298500840a4b9a53365ee11449af0cf25886f25f206b
MD5 094fe951e317efb61ed1f050cd6d4220
SHA1 a9ee17b0573d9191da8242f6922075e3c2a021a2
SHA512 9a0571f51deced515e3c125ef54bbc30e7d1afb45d8bd2d84525b8cc555c36cad0cefd6cf8c1a8b68e7eaef7d3f23eab133680387ae3cb26d24ca8d40fcd0f58
SSDEEP 3072:FMpnpSAVsM5kg5g5QazekgwFBqYWtRzCWac/QF/l7bzhcxYM2L0fVnCJxt2VkCJX:4SAVsM5k2eknCwkC0wjQ7D8wfS
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ceb1wvbq.kqp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ceb1wvbq.kqp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 11B
SHA256 6c3bbbc37037c45f6cfd5100f7ce860cfed590bae6ed2a844d353fdfaa7c329c
MD5 630ce4b131a85c9367238355707b2fa3
SHA1 fe5655144f2faa2f4e2c2595da99bfa9d169e63b
SHA512 8a25a5489cd6a0c203d495f928271221c1e2cfba25cff7b5698d8d071894e2be9c67a2e9fbac1c95ecb6e194c54e603ccc00d4477fffeb0f0109cba3a4d0d617
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 11B
SHA256 2556082038f3a5bd5752b774971e7a5744a5f7a17452277ef46b215c73de2132
MD5 8da145462f785db926f4289d0a9c2fdb
SHA1 32c2bd035bdc95f1d3c7ed4850545004653eb1ed
SHA512 958fc6e754036bba5cdee1638639586ccde6b3adc6deadc5c8ac1cf10e8a06db9d3c44d13957eab0ca2d31ba70adfdac5e6be6616ebc1d109a91b27700044caa
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 10B
SHA256 b0eacbaca80bce3d73d60c5ee14e219573474fcf9c94a269e61746b09f6e1fba
MD5 28b4ffd6efb374469609c1d8fba31c4d
SHA1 6e70d8ce6a3d22c3f8e1ed7aa5b70556712331f8
SHA512 88ff8492390e577770f1a47d773c981b2f662962d37f6ad43eec40571442dd0c9300f88af51e5dc91fa62274e8498c4d2b8106ef910af7eb8299fd69268dac0f
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 9B
SHA256 cd8746fce7c39374e2612724cb78ba4d6d8bf9a326d0804f464516039c7a482f
MD5 1e930993fa6581249e4c13726d1cb09d
SHA1 f34f88fddcea971d4ee8cfd27b18f62fd11f5df2
SHA512 b918c8360e8d5b998e8e92ec2e075dab749c0faabb3a652d3c92338985f01912664d0828b9cb061786b32ce875d1bd718baccdf32c7553ccda15dbdc3216883a
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 10B
SHA256 969df9f0b907b29ea0c707e677b3cfccc845eeb9c79a0f876ccc3c0a19f49aa0
MD5 f59c8225d45fea0c2f3ac81076972e64
SHA1 eab8e70c711290d71e86aad0de22bbc470f0272c
SHA512 d3783e7f962b14af39274a5fe3dfdf0b9c05dfd2c9142686c4b68af6dc6d6c558ef39996ed047696224294e09b2ef9fe8916d9afe1ce73ea85572f6d4f4ef67a
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 10B
SHA256 150ae6592f59877a6e0aaac15db93d01bc6b77e026f2d58e0a5cc2b522319b96
MD5 36e95110bfe5c7e3f094ae3f15c5a522
SHA1 79f4c8882af66200d903286174545c0012b55910
SHA512 a16962f2581cf3c36a25b37e6811b2ffc11dc18e9dd274aff65bceaa10f19c4351370dc563f0cfde65a8918d24493eaac26cdae7f3fdd55785e7123803dc9af7
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 48B
SHA256 c146fe1ea70d4f8919324ebf2e05386a081365b006f14fa7d4de18e16b08b7b8
MD5 91418fff4aedc3c32effe9e134de31c7
SHA1 9e399d8a14d2848736e3e79d9768f9384ffdfaf0
SHA512 611f10e011b458a77bf94b5cfb0f7f5a8095df46f2e41db491ae7407264acd059cc728cb1837ab0274c481b6dd7e156f45608450ab707036310acd9fcee00349
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 10B
SHA256 fecce82f4a5d654559b54faf3ef53883afe14c260b6ee7170a06eeaad7d30abf
MD5 9e699fe700519772efa1b6f45b23e10e
SHA1 c4a81031ca2fd39e523e9d6aeb8d3ab712d82745
SHA512 8e9c857eef024c1f13cc5a3d37bb3c760279b7f3e7e69654ac8af02da3c265c102f2675adf88c85ce9815232e5dbb5c39f2e2b477769a94bd58934d1fd3c5ca3
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 23B
SHA256 30a27a15ee3b707af70bcf7e3010c8d95fb2210c5f2ec39b3cbc11030a8d971d
MD5 314facf04e765b8d30c8394a8db979cf
SHA1 898c853f7367027f3f9755ae28c9ab5d3d7aceda
SHA512 ae4350a37227b38c707b12e323f309091fd0f1bcb56a1b912bb2fe7d9ea89982c588beb2dbdde637fcbf9af2cfbe35deb0c461b36ea57d2c9319ac4d765b4d60
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 10B
SHA256 6f64b34df0d4a3cde3050a75636f79354f5c800e0fbf50d6456a371b63926120
MD5 cf0e6212974313466638c2ee46fb0d0f
SHA1 e59d48fb0dd400f65d62f542b554b0157adb7735
SHA512 4e2f23238b889f84b59e0d83b5ef2e3981bbfa4506f114b2e53986eae7cb0a028c59ed6f039428be0dbea67df6de454c611ee4016f3327ce88cab7bd63172395
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 38B
SHA256 08b46b6d09e7678b034b1ccf96a366f71d001127554bef9fd97fff7873beda99
MD5 3884887f65745965da0fe42ff68e8e46
SHA1 5001b2948c288653e16248f8761b4c9ed8900044
SHA512 9ed3406b7272eee3a13731f1649e1fd2f3273f472f5dc192e749afd0ac5e4f4f7d46d4447212b880f8730bb3b46bf0c842d3648a6101f1493b7a111b72e09788
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 8B
SHA256 fbfaac26f2d0240a0764407c4848e8989b09855988f63023b4b0faec9970d929
MD5 69fbb26c1d8f4df2a309f9cf88340928
SHA1 990792f5db60f5a27fed21303039459dca6cc877
SHA512 7c60adc20b4df64f34c1e727d650de14509bd1033e86c22729de4eb958ae92e14cdb920a902f8605f21b23c714b34017454c89db352d0f299b019283388367b3
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 32B
SHA256 037dc57dd95d18bf446bfc091c84df9659c83ec31a2bf28332833a2af902d10c
MD5 4e13bc2227bf31265b8db09593cb3657
SHA1 85ad3efe4613e7a37d697b9a72e0bc1bcbda1c57
SHA512 c699d077d94a6b37239dc2da072f62f947bd140d7be9b8ccb3338fe101dfb9aff07b99aa2b924e20df1a99abf4f18089ce1d9d9c16fdd5d0468d1e8f24cdbf15
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 19B
SHA256 92eddbb3afb6348f90603b48a65b7e3d300b525107b5d6299b5738d2517d4dff
MD5 943471f039cb82d7e5a146f2397807c3
SHA1 fc5d5e2f5bd4caf930ae823a080754b3bc3c8d2e
SHA512 25dec352d18b6263ffefaadf8f5acb0509a4a437425a8d9af96623696f7d6db5d1f9bc6197ecfffbbfad10c045ab5a6f71ba074d45e9d1388fac40533bbb4b8d
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 32B
SHA256 6921ef6e2f742568023da2ec7bb3eb0e0b0d85820c1471a0c95c959dac19c8be
MD5 266b2aabcd30d0afd83540daae99a22b
SHA1 6e94ebdc327d1581eab746c27cfe816948c38ab7
SHA512 738cf6d936301f1b049e934710002432b6a2689aceaeb3be80b6dbcb41deadf553d83fa7ea8851234e6917e1582da6545aaf22b0e31e0c5baa9144e68bea4051
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 29B
SHA256 aa03808fa7d3d597c9532b62ac48a55e5796cc947fedc98becb5e41f15f8e2e9
MD5 a81cced386011e782b43c0d3251b560b
SHA1 6b7d165226b6a6a9c09c114917d6f7b70ed3d52b
SHA512 215273e2c7f2dee477cf55db257cf91b6c9666ab21d8cb07f273371239bc267b8ef634ca9ea396fe4252351fe64f60eac436faedab1bd8d2d78234cf3fa95608
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 32B
SHA256 59204b27e2569e9c5a481af3886abe6bc4b8dda6a450102b84612e72a90f151c
MD5 970785299fcc92ab24103af56c64cfd3
SHA1 72a8bada2a8aa69634c5b7ac2bb850c8ef3f3d48
SHA512 93dbf4989db1e7cf5fda8ff02ebd2eacc4ae74142ddd328a103c3034724eea04621777dc742a6a347bad91468b4890675efddc8024f05a35eb9f13dd7c73dc81
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 32B
SHA256 1c5ac8e25fd1e5848d752fde2b7e5b1a418b1e896c7324006025942734a3052f
MD5 f8263a827d2cc8ecee893b3051f0f0d4
SHA1 927bb7b2dfa41097a016aedb3c8741373f439787
SHA512 d18abbd486ef475cb71e3eb483992d88324a495cea6e7eefbc95d940ec46dfe108d40c5bc0b92052c1fd2d0a873648571d490cad8994506dc5369a8f196373cc
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 20B
SHA256 a4307857231aad4e1ad6c49fd5cc4e5ecaa593cf671fbe48c3002e4fa604fdf2
MD5 8d0147ec334f4b2567029dfce703fcde
SHA1 b1821df7c08d996d0d4fd09165ba2c6e2b2ecc24
SHA512 6e3d14675079e0c5869a1879c5a33e8082b2ad90a716fe9f6d66a660a40ee110935c0bbb668b8bf4c190e9fb28582d6c4e9942b04c7a30417323dafe2146aeea
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 18B
SHA256 db036483e8b88559a05534170f842bf0339f6f258122845568345ec8e4402782
MD5 c82a9ecd14c067e8a52e2ae041d5790f
SHA1 9491863a587f01917a6de13235721f769f4ecbf9
SHA512 127ab799d673ad3ec8d2ed7e9fff5758ed241b1be6c3039c499385b35dc9f7db007d92477c905995da69b7f4679ef528352f5ea2978e23bc2f4017dbdbdf4b78
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 20B
SHA256 702ef14a4166667a42ee50f5a04298c951ba7464653e04ea04a6610386ac6c33
MD5 599f806a626dda2fa2cbc755e98b5bb4
SHA1 30d69b664f0eb40102a1de9dc34e7a2fa33f21e5
SHA512 318a531b6991ec1bebc21ded11555c3043e6674eb68b11218aa47ac4782463c3e8d58620a5b6d69860a659ac383cd3cc404fc659c85c839ecbba7f30b9fb981e
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 32B
SHA256 6ac5c33ccc6b9db0424c3c38acda4ee0aacf21155aef111857f4889080c93400
MD5 0efa62e28f946112649b917f19e96c90
SHA1 be33e7fb85194a025460bf9dabd7236e7935e7ba
SHA512 6497b3aea9d35fbbbf87f8253e61442e590f3a432ed53e166aa3d14c9d54afd73da0b1b44850b6f6e00674e427b818dafaa1c463057be0f5baba0d9edcf962d9
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 8B
SHA256 ea94e743be9a8e6c294bccf4f3f7bd0a0f459aecb6d272098e91eab3fade3a23
MD5 9e5bc90abc2d668ec0edeafd847a367c
SHA1 f12743d1f5407546eb70c162d53d6a05870b680f
SHA512 17f5ad246b0d93e7f3d51227797ac6f0a380799a688c8dd1ab233d82938d1b21c86a2a256e42e6814d3efed24252101f4082c056bd17366a1a70aad7aa090649
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 23B
SHA256 5b0e23aef6a89ee46f0b96fc8a820dc9feca59ff3c2a49b1979f692796a4c9d7
MD5 e75b24a3f3a9a5e65ee890cc95be6949
SHA1 89b90b0251baa77a186d00ef3e8ffc76edd65aba
SHA512 3887322d4f485379980c4130d3109824fe54558e3836bf68fe01d1842b5cc5acda726b8fc4a70d7f2df5e00ba329061eb2e606bd3a2d956974675f873777d0ff
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 9B
SHA256 c9061f8a635d7b49893673b6c69d3c400972e45f221f698efde216d476f9387e
MD5 44f81b751ab0e430f91039661badb994
SHA1 8c6c0a80f9545745bccb1dc60208e90954c025ec
SHA512 e5dd78db2bab945bcbb56242579e82ea670033410f48f22c5dd52621db1811be2c7e1dc134ab563355113e437b536a8e5abf931fa700705721a89172a5e1aa8e
MD5 SHA1 SHA512

Submit Download

blackbird-gui.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbird-gui.tmp
Size 32B
SHA256 823762c92e56396a66bbcac80faa9a3f52f7b05351dbd43369a22dad8c38d010
MD5 3c0e051cae923ef7acf4d09afdfd0427
SHA1 a7c7b28c1f749cf9e1514c9d2198b7c08ceb5d05
SHA512 0b6192ca85587a765591409900ac45c333f600ed08f4dc1a10993317d6d048cd0beb05981109b738fe5527fd92e5ee2d819d273f55bf0c5c49e594a5966abee4
MD5 SHA1 SHA512

Submit Download

blackbird.tempsch_raw.tmp

Path C:\Users\Admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp
Size 3KB
SHA256 c6bb31338d16a8fd3a09ec41fb010f67a75999ace6981a9d7965cab15d3f9a44
MD5 54acdd4639cb80d35c61bfecfa767d70
SHA1 14aeed34ef32cb585cbc96eb809c5b4fd7312b87
SHA512 64c648b6ffb942632a4d39219a8e2861b0b2f8f6e817e3a0ac65259997c777c740c67cd00db4389fbc5e50fedc52fa4488b2c989456a5e7112c7eea7167be7fb
MD5 SHA1 SHA512

Submit Download

memory/232-0-0x0000000140000000-0x00000001400B7000-memory.dmp

Download

memory/232-32-0x0000000140000000-0x00000001400B7000-memory.dmp

Download

memory/1980-162-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/1980-163-0x000001EBFA5E0000-0x000001EBFA5F0000-memory.dmp

Download

memory/1980-175-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/1980-173-0x000001EBFA5E0000-0x000001EBFA5F0000-memory.dmp

Download

memory/2036-205-0x000002E5BBAD0000-0x000002E5BBAE0000-memory.dmp

Download

memory/2036-198-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/2036-207-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/2036-204-0x000002E5BBAD0000-0x000002E5BBAE0000-memory.dmp

Download

memory/2036-200-0x000002E5BBAD0000-0x000002E5BBAE0000-memory.dmp

Download

memory/2556-145-0x0000026E6D870000-0x0000026E6D892000-memory.dmp

Download

memory/2556-158-0x0000026E6D730000-0x0000026E6D740000-memory.dmp

Download

memory/2556-157-0x0000026E6D730000-0x0000026E6D740000-memory.dmp

Download

memory/2556-156-0x0000026E6D730000-0x0000026E6D740000-memory.dmp

Download

memory/2556-161-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/2556-155-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/3904-222-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/3904-217-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/3904-218-0x000001946F620000-0x000001946F630000-memory.dmp

Download

memory/3904-219-0x000001946F620000-0x000001946F630000-memory.dmp

Download

memory/3904-220-0x000001946F620000-0x000001946F630000-memory.dmp

Download

memory/4364-185-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/4364-192-0x00007FFC8B200000-0x00007FFC8BCC1000-memory.dmp

Download

memory/4364-190-0x000001E3E8F10000-0x000001E3E8F20000-memory.dmp

Download

memory/4364-188-0x000001E3E8F10000-0x000001E3E8F20000-memory.dmp

Download

memory/4364-186-0x000001E3E8F10000-0x000001E3E8F20000-memory.dmp

Download

memory/4364-187-0x000001E3E8F10000-0x000001E3E8F20000-memory.dmp

Download