32ebdb5eb8be7401acac75f791e9a018a96329179ddae30963e1cde6fcf84d8a

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

code.vbs
Size

1KB
MD5

10e6ce0cef8e5e4d696abce1935848b2
SHA1

39cad1402cfecb68cdd9ad8a0255ad90e2989387
SHA256

32ebdb5eb8be7401acac75f791e9a018a96329179ddae30963e1cde6fcf84d8a
SHA512

1d1f0eb5f3d76327f1f2bb3e6e4191b4488510199c92deccd641a41502d83847e1fe8aaa080860153bedc687f8ed454d580872aa9da4303924245ddbcadcb745

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Invoke Powershell command.

execution

PowerShell

T1059.001

pid	Process
1648	powershell.exe
2132	powershell.exe
1532	powershell.exe
1140	powershell.exe
1276	powershell.exe
1576	powershell.exe
536	powershell.exe
2500	powershell.exe
1728	powershell.exe
484	powershell.exe
2368	powershell.exe
2848	powershell.exe
2212	powershell.exe
1052	powershell.exe
1944	powershell.exe
992	powershell.exe
2700	powershell.exe
2280	powershell.exe
2220	powershell.exe
1756	powershell.exe
2220	powershell.exe
1016	powershell.exe
1940	powershell.exe
2144	powershell.exe
2596	powershell.exe
1116	powershell.exe
1044	powershell.exe
2512	powershell.exe
1884	powershell.exe
1344	powershell.exe
1500	powershell.exe
2556	powershell.exe
1668	powershell.exe
1044	powershell.exe
1868	powershell.exe
2580	powershell.exe
2060	powershell.exe
1708	powershell.exe
2688	powershell.exe
2024	powershell.exe
2900	powershell.exe
1096	powershell.exe
2188	powershell.exe
896	powershell.exe
2496	powershell.exe
1264	powershell.exe
3032	powershell.exe
1680	powershell.exe
2560	powershell.exe
2368	powershell.exe
536	powershell.exe
1076	powershell.exe
1276	powershell.exe
380	powershell.exe
2508	powershell.exe
1576	powershell.exe
2544	powershell.exe
636	powershell.exe
860	powershell.exe
2324	powershell.exe
2708	powershell.exe
2632	powershell.exe
1520	powershell.exe
1008	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3028	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 7 IoCs

evasion

pid	Process
2768	taskkill.exe
2664	taskkill.exe
1576	taskkill.exe
2940	taskkill.exe
2696	taskkill.exe
2528	taskkill.exe
2584	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1884	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	tasklist.exe
3028	tasklist.exe
872	powershell.exe
1200	powershell.exe
2968	powershell.exe
1448	powershell.exe
2024	powershell.exe
2436	powershell.exe
2600	powershell.exe
1736	powershell.exe
2144	powershell.exe
1076	powershell.exe
1332	powershell.exe
336	powershell.exe
1028	powershell.exe
1704	powershell.exe
2556	powershell.exe
2688	powershell.exe
2768	powershell.exe
2264	powershell.exe
2592	powershell.exe
1380	powershell.exe
2280	powershell.exe
2544	powershell.exe
1560	powershell.exe
1664	powershell.exe
2096	powershell.exe
2436	powershell.exe
1432	powershell.exe
2600	powershell.exe
1216	powershell.exe
1700	powershell.exe
1876	powershell.exe
2500	powershell.exe
2972	powershell.exe
1108	powershell.exe
1588	powershell.exe
3032	powershell.exe
2132	powershell.exe
2224	powershell.exe
2940	powershell.exe
2144	powershell.exe
1148	powershell.exe
2540	powershell.exe
2356	powershell.exe
576	powershell.exe
1548	powershell.exe
2052	powershell.exe
3000	powershell.exe
1436	powershell.exe
624	powershell.exe
2876	powershell.exe
2832	powershell.exe
1800	powershell.exe
1100	powershell.exe
1188	powershell.exe
2388	powershell.exe
2900	powershell.exe
2976	powershell.exe
2608	powershell.exe
484	powershell.exe
1116	powershell.exe
2784	powershell.exe
1508	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	WScript.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1884	2336	WScript.exe	30
PID 2336 wrote to memory of 1884	2336	WScript.exe	30
PID 2336 wrote to memory of 1884	2336	WScript.exe	30
PID 2336 wrote to memory of 2072	2336	WScript.exe	32
PID 2336 wrote to memory of 2072	2336	WScript.exe	32
PID 2336 wrote to memory of 2072	2336	WScript.exe	32
PID 2072 wrote to memory of 2944	2072	cmd.exe	34
PID 2072 wrote to memory of 2944	2072	cmd.exe	34
PID 2072 wrote to memory of 2944	2072	cmd.exe	34
PID 2944 wrote to memory of 3028	2944	cmd.exe	35
PID 2944 wrote to memory of 3028	2944	cmd.exe	35
PID 2944 wrote to memory of 3028	2944	cmd.exe	35
PID 2944 wrote to memory of 2624	2944	cmd.exe	36
PID 2944 wrote to memory of 2624	2944	cmd.exe	36
PID 2944 wrote to memory of 2624	2944	cmd.exe	36
PID 2072 wrote to memory of 2768	2072	cmd.exe	38
PID 2072 wrote to memory of 2768	2072	cmd.exe	38
PID 2072 wrote to memory of 2768	2072	cmd.exe	38
PID 2072 wrote to memory of 2664	2072	cmd.exe	39
PID 2072 wrote to memory of 2664	2072	cmd.exe	39
PID 2072 wrote to memory of 2664	2072	cmd.exe	39
PID 2072 wrote to memory of 1576	2072	cmd.exe	40
PID 2072 wrote to memory of 1576	2072	cmd.exe	40
PID 2072 wrote to memory of 1576	2072	cmd.exe	40
PID 2072 wrote to memory of 2940	2072	cmd.exe	41
PID 2072 wrote to memory of 2940	2072	cmd.exe	41
PID 2072 wrote to memory of 2940	2072	cmd.exe	41
PID 2072 wrote to memory of 2696	2072	cmd.exe	43
PID 2072 wrote to memory of 2696	2072	cmd.exe	43
PID 2072 wrote to memory of 2696	2072	cmd.exe	43
PID 2072 wrote to memory of 2528	2072	cmd.exe	44
PID 2072 wrote to memory of 2528	2072	cmd.exe	44
PID 2072 wrote to memory of 2528	2072	cmd.exe	44
PID 2072 wrote to memory of 2584	2072	cmd.exe	45
PID 2072 wrote to memory of 2584	2072	cmd.exe	45
PID 2072 wrote to memory of 2584	2072	cmd.exe	45
PID 2336 wrote to memory of 760	2336	WScript.exe	46
PID 2336 wrote to memory of 760	2336	WScript.exe	46
PID 2336 wrote to memory of 760	2336	WScript.exe	46
PID 2336 wrote to memory of 2968	2336	WScript.exe	47
PID 2336 wrote to memory of 2968	2336	WScript.exe	47
PID 2336 wrote to memory of 2968	2336	WScript.exe	47
PID 2336 wrote to memory of 872	2336	WScript.exe	49
PID 2336 wrote to memory of 872	2336	WScript.exe	49
PID 2336 wrote to memory of 872	2336	WScript.exe	49
PID 2336 wrote to memory of 1200	2336	WScript.exe	51
PID 2336 wrote to memory of 1200	2336	WScript.exe	51
PID 2336 wrote to memory of 1200	2336	WScript.exe	51
PID 2336 wrote to memory of 1448	2336	WScript.exe	53
PID 2336 wrote to memory of 1448	2336	WScript.exe	53
PID 2336 wrote to memory of 1448	2336	WScript.exe	53
PID 2336 wrote to memory of 2024	2336	WScript.exe	55
PID 2336 wrote to memory of 2024	2336	WScript.exe	55
PID 2336 wrote to memory of 2024	2336	WScript.exe	55
PID 2336 wrote to memory of 2436	2336	WScript.exe	57
PID 2336 wrote to memory of 2436	2336	WScript.exe	57
PID 2336 wrote to memory of 2436	2336	WScript.exe	57
PID 2336 wrote to memory of 2600	2336	WScript.exe	59
PID 2336 wrote to memory of 2600	2336	WScript.exe	59
PID 2336 wrote to memory of 2600	2336	WScript.exe	59
PID 2336 wrote to memory of 1736	2336	WScript.exe	60
PID 2336 wrote to memory of 1736	2336	WScript.exe	60
PID 2336 wrote to memory of 1736	2336	WScript.exe	60
PID 2336 wrote to memory of 1076	2336	WScript.exe	63

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\note.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c for /f "tokens=1 delims= " %a in ('tasklist /v ^| findstr /i /v "N/A"') do taskkill /f /pid %a >nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /v | findstr /i /v "N/A"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\tasklist.exe
      tasklist /v
      4⤵
      Enumerates processes with tasklist
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3028
  - - C:\Windows\system32\findstr.exe
      findstr /i /v "N/A"
      4⤵
      PID:2624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid Image
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid =========================
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid taskhost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid dwm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid dllhost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid notepad.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-Command { Add-Type @" using System; using System.Runtime.InteropServices; public class CursorPosition {[DllImport("user32.dll")]; public static extern bool SetCursorPos(int X, int Y);}"@ }; [CursorPosition]::SetCursorPos(100, 100);
  2⤵
  PID:2548

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
21B

MD5
47e842ce84d617b378e86d4af78baf5c

SHA1
38be9828aa5b485b560431348fbe2b2c6063f40c

SHA256
5dd0174fa7779bcd76d89f73f6d091a3fcb1866e09291f1394c22194939669c3

SHA512
c4513bf9e5ce559fba0a5900836b17acd4804b13afe54df0842c42ed25feb61bdfabeab18e520e21878e9a6773b19b5a1ba2464e159507990cb5016d7a49afe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\note.txt

Filesize
78B

MD5
f43a064ff5e8089214dd393bd99ff6fc

SHA1
31e2b291ecd73f84b5ae3f24749f10da27fef612

SHA256
54d4a587f44c55e37c574998a065b9f8b5ff2f975220e3d3ab7c93ff80b55786

SHA512
2af9e90e68fe6d84ab565f9b6a6e41a2292501c1eed90cb48f0d3d07787f34581d701382afd204057a85b80557807542717fc0a4e1a14c8507f83e86ccb03769

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e614622915a9496dca65139aa00e2644

SHA1
d91a6400491c6c0133e1914db8b1dfbd70b9af31

SHA256
2a59046c3c97eb72f2921bc7ff0350306fd73501e0f23d9dff0ee6b43669fd44

SHA512
c3d94509c9d9f8ce9ef412b35d8f787bf2e139a29e36759f2505e1cbe84edf90613f6f8d98b0dd467c27cae38b5a2a93e231549a1d2eb381e3aa123e77884611

Download Submit
memory/872-18-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/872-19-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download